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JACOB IAN GROUP ELEMENT ADDER 

BACKGROUND OF THE INVENTION 

The present invention relates to a Jacobian group 
5 element adder, and more particularly technology for 

discrete logarithmic cryptography employing a Jacobian 
group of an algebraic curve (hereinafter, referred to as 
algebraic curve cryptography) that is a kind of the 
discrete logarithmic cryptography, which is cryptography 

10 technology as information security technology. 

It is an elliptic curve cryptography that has come in 
practice most exceedingly among the algebraic curve 
cryptography. However, an elliptic curve for use in the 
elliptic curve cryptography is a very special one as 

15 compared with a general algebraic curve. There is the 

apprehension that an aggressive method of exploiting its 
specialty would be discovered in the near future. For this, 
so as to secure safety more reliably, a general algebraic 
curve of which specialty is lower is desirably employed. 

20 Cab curve cryptography is known as an algebraic curve 

cryptography capable of employing a more general algebraic 
curve as mentioned above. 

The Cab curve cryptography, however, is less employed 
in the industrial field as compared with the elliptic 

25 curve cryptography. Its main reason is that the 




conventional additive algorithm in the Jacobian group of 
the conventional C a b curve is tens of times slower than 
additive algorithm in the Jacobian group of the elliptic 
curve, and as a result, process efficiency of 
5 encryption/decryption in the C a b curve cryptography is 
remarkably inferior as compared with the elliptic curve 
cryptography, which was shown in "Jacobian Group Additive 
algorithm of C ab Curve and its Application to Discrete 
Logarithmic Cryptography" by Seigo Arita, Japanese-version 
10 collection of The Institute of Electronics, Information 
and Communication Engineers, Vol. J82-A, No. 8, pp. 1291- 
1299, 1999. 

Also, another additive algorithm in the Jacobian group 
of the Cab curve was proposed in " A Fast Jacobian Group 

15 Arithmetic Scheme for Algebraic Curve Cryptography" by 

Ryuichi Harasawa, and Joe Suzuki, Vol. E84-A No.l, pp. 130- 
139, 2001 as well; however, even though an asymptotic 
calculation quantity of algorithm was given, no execution 
speed data in a packaging experiment was shown, and, also, 

20 no report on the packaging experiment by a third party was 
provided, and the extent to which the execution speed can 
practically be achieved is uncertain. 

As seen from the foregoing, non-efficiency of the 
additive algorithm in the Jacobian group of the C a b curve 

25 prevents the cryptography of the above curve from coming 



in practice, which gives rise to the necessity of 
executing addition in the Jacobian group of the C a b curve 
at a high speed. 

DISCLOSURE OF THE INVENTION 

The present invention has been accomplished in 
consideration of such problems, and an objective thereof 
is to provide a Jacobian group element adder that enables 
the additive algorithm in the Jacobian group of the c a b 
curve to be executed at a high speed. 

The Jacobian group element adder in accordance with 
the present invention, which is an arithmetic unit for 
executing addition in a Jacobian group of an algebraic 
curve defined by a polynomial defined over a finite field 
that is 

Y 3 + a 0 X 4 + a iXY 2 + a 2 X 2 Y+ a 3 X 3 + a 4 Y 2 + a 5 XY+ a 6 X 2 + a 7 Y+ a 8 X+ a 9 
or 

Y 2 + a 0 X 5 + a iX 2 Y+ a 2 X 4 + a 3 XY+ a 4 X 3 + a 5 Y+ a 6 X 2 + a 7 X+ a 8 
or 

Y 2 + a 0 X 7 + a iX 3 Y+ a 2 X 6 + a 3 X 2 Y+ a 4 X 5 + a 5 XY+ a 6 X 4 + a 7 Y+ a 8 X 3 -t- a 9 X 2 + a 
ioX+an, is characterized in comprising: 

means for inputting an algebraic curve parameter file 
having an order of a field of definition, a monomial orde 
and a coefficient list described as a parameter 
representing said algebraic curve; 



means for inputting Groebner bases I 1 and I 2 of ideals 
of the coordinate ring of the algebraic curve designated 
by said algebraic curve parameter file, which represent 
elements of said Jacobian group; 

ideal composition means for, in the coordinate ring of 
the algebraic curve designated by said algebraic curve 
parameter file, performing arithmetic of a producing 
Groebner basis J of the ideal which is a product of the 
ideal that the Groebner basis Ii generates, and the ideal 
that the Groebner basis I 2 generates; 

first ideal reduction means for, in the coordinate 
ring of the algebraic curve designated by said algebraic 
curve parameter file, performing arithmetic of producing a 
Groebner basis J* of the ideal, which is smallest in the 
monomial order designated by said algebraic curve 
parameter file among the ideals equivalent to an inverse 
ideal of the ideal that the Groebner basis J generates; 
and 

second ideal reduction means for, in the coordinate 
ring of the algebraic curve designated by said algebraic 
curve parameter file, performing arithmetic of producing 
a Groebner basis J** of the ideal, which is smallest in 
the monomial order designated by said algebraic curve 
parameter file among the ideals equivalent to an inverse 
ideal of the ideal that the Groebner basis J* generates to 



output it. 

[C ab curve and its Jacobian group] 

The Cab curve C to be treated in the present invention 
is a nonsingular plane curve to be defined by a polynomial 
F(X,Y) having the following formula for two natural 
numbers a and b that are relatively prime. 
F(X, Y)=Y a +c 0 X b +Sc i , j X*Y j 

Here, indexes i and j in the above equation, which are 
natural numbers equal to or more than zero, vary in a 
range of ai+bj<ab. Also, suppose that c 0 and ci,j are 
elements of a defining field k, and that c 0 is not zero. 
The Cab curve C has a unique point at infinity P TO , and the 
polynomials Y and X have a unique b-order pole and a-order 
pole at P ro respectively. Set a group subtended by divisors 
of degree 0 on the C ab curve C to D c °(k), and set a group 
composed of principal divisors to P c (k). 

A Jacobian group J c (k) of which the additive algorithm 
is required to be found in the present invention is 
defined as 
J c (k)=D c °(k) /P c (k) 

On the other hand, let R=k[X,Y]/F be the coordinate 
ring of the C a b curve C, it follows that the ring R becomes 
an integrally-closed integral domain, which is a Dedekind 
domain, because the C a b curve C is nonsingular by 
definition. Thus, all of the fractional ideals of the ■ 




ring R that is not zero compose a group I R (k) . Set a 
subgroup by subtended by the principal ideal of the ring R 
to P R (k), then an ideals class group H R (k) of the ring R 
is defined as 
5 H R (k)=I R (k) /P R (k) 

As a rule, it is known that, for the nonsingular 
algebraic curve, the divisor on the curve can be 
identified with the ideal of the coordinate ring, and that 
its Jacobian group and the ideal class group are of 

10 intrinsic isomorphism. In particular, a Jacobian group 

J c (k) of the Cab curve C and the ideal class group H R (k) of 
the coordinate ring R are of intrinsic isomorphism. The 
ideal is more convenient than the divisor for packaging 
algorithm, whereby, hereinafter, the Jacobian group J c (k) 

15 of the C ab curve C is treated as the ideal class group 
H R (k) of the coordinate ring R. 
[Preparation relating to a Groebner basis] 

Since the Groebner basis of the ideal is employed in 
calculation of which an object is the ideal class group 

20 H R (k), a preparation relating hereto is made in this 

chapter. As a rule, for a polynomial ring S=k [Xi, X n ] , an 
order f < ? among its monomials, if it is compatible with a 
product, that is, Mi<M 2 always yields M1M3, is called a 
monomial order. In this chapter, from now on, suppose an 

25 arbitrary monomial order ' < f is given to a polynomial ring 




s. 

For a polynomial f in S, call the largest monomial in 
the monomial order 1 < f that appears in f a leading 
monomial of f, which is denoted by LM(f). Also, for an 
5 ideal I, LM(I) denotes an ideal that is generated by 
leading monomials of the polynomial belonging to 1 
generates by LM(I). 

For an ideal 1= (f i, f s ) of S that is generated by a 
polynomials fi,...,f s , when {fi,...,f s } meets 

10 IM ( I) = (LM (f i) , LM (f s ) ) , {fi,...,f s } is called a Groebner 

basis of the ideal I. For the ideal I of the polynomial 
ring S, the entirety A (I) of the monomial (or its multi 
degree) A (I) that does not belong to LM(I) is called a 
delta set of I. When (multi degrees of) monomials in A (I) 

15 are plotted, a convex set appears, and a lattice point 
encircling its convex set corresponds to the leading 
monomial of an element of the Groebner basis of I. Also, 
A (I) subtends the basis of a vector space S/I over k. 
The ideal 1 of an the coordinate ring R=S/F of a 

20 nonsingular affine algebraic curve C can be identified 
with the ideal of the polynomial ring S that includes a 
defining ideal F of the curve C. Thus, for the ideal of 
the coordinate ring R as well, as mentioned above, 
Groebner basis can be considered. For a zero-dimensional 

25 ideal I (that is, a set of zeros of I is a finite set) of 



the coordinate ring R=S/F, call a dimension of a vector 
space S/I over k an order of the ideal I, which is denoted 

by 5 (I) . Immediately from definition, it can be seen that 
5 (I) is equivalent to the order of the set A (I). Also, by 

assumption of being nonsingular, it follows that 8 (IJ)=5 
(I) 5 (J). When I=(f) is a principal ideal of R, then 8 
(I) =-v Poo (f ) , where v Poo (f) represents a valuation of the 

polynomial f at Poo. 

[Additive algorithm on Jacobian group of C ab curve, part 1] 
Now think about the coordinate ring R=k[X,Y]/F of the 
C ab curve C defined by the polynomial F(X,Y). Regard the 
monomial of two variables X ra Y n as a function on the curve C 
and call the monomial order obtained by ordering the 
monomials based on the size of a pole order-v Pco (X m Y n ) 
at P ro a Cab order. Here, in the case that the pole orders 
at Poo thereof are the same, the monomial with the larger 
is supposed to be larger. Hereinafter, the C ab order is 
employed as the monomial order of the coordinate ring R of 
the C ab curve C. For the ideal I of the coordinate ring R, 
let fj be the non-zero polynomial with the smallest 
leading monomial among the polynomials in I. Furthermore, 
let l*=(f I ):i(= {g^Rig • ic (f x ) } ). 

Now, it can be easily shown that, when I and J are 
arbitrary (integral) ideals of the coordinate ring R, then 
(1) I and I** are linearly equivalent, (2) I**, which is 



an (integral) ideal equivalent to I, has the smallest 
order among ideals equivalent to I, and (3) if I and J are 
equivalent, then I*=J*, in particular, i**=(i**)**. For an 
ideal I of the coordinate ring R, when I**=(I), we call I 
a reduced ideal. From the above-mentioned equations (1) 
and (3) , an arbitrary ideal is equivalent to the unique 
reduced ideal. That is, the reduced ideals compose a 
representative system of the ideal classes. This property 
is not limited to the C ab order, and holds also in the 
event of having employed an arbitrary monomial order; 
however, in the event of having employed the C a b order, 
from the above-mentioned equation (2) , the reduced ideal 
has the property of becoming an ideal of which the order 
is the smallest among the equivalent ideals. This is 
advantageous in packaging the algorithm. Using reduced 
ideal as a representative system of the ideal classes, we 
obtain additive algorithm on Jacobian of C ab curve, 
mentioned below. 

[Additive algorithm on Jacobian group 1] 

Inputs: reduced ideals I 1 and I 2 of the coordinate 
ring R 

Output: a reduced ideal I 3 equivalent to an ideal 
product Ii • I 2 



[Classification of ideals] 

So as to realize the above-mentioned additive 
algorithm on Jacobian group 1 as a program that is 
efficient, and yet is easy to package, the ideals that 
appear during execution of the additive algorithm 1 are 
classified. Hereinafter, for simplification, explanation 
is made with a C 34 curve (that is, the C ab curve with a=3, 
and b=4) taken as an object; however, for the general C ab 
curve as well, the matter is similar. A genus of the C 34 
curve is 3, whereby the order of the ideal that appears 
during execution of the additive algorithm 1 is equal to 
or less than 6. The Groebner bases in their C 34 orders are 
classified as follows order by order. However, from now on, 
even though a defining equation F of the C 34 curve C 
appears in the Groebner basis of the ideal, F is omitted, 
and is not expressed. Also, coefficients a ± , bj, and c k of 
each polynomial constructing the Groebner basis are all 
elements of k. 
(Ideal of order 6) 

Suppose I is an ideal of order 6 of the coordinate 
ring R. By definition of the order, V=R/I is a six- 
dimensional vector space over the defining field k. When 
six points that the ideal I represents are at a 
"generalized" position, six monomials from the beginning 
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in the C 34 order 1, X, Y, X 2 , XY, and Y 2 are linearly 
independent at these six points. That is, the monomials 1, 
X, Y, X 2 , XY, and Y 2 compose a basis of the vector space V. 
At this time, we call such an ideal I an ideal of a type 
5 61. 

As a rule, a delta set A (I) of the ideal I can be 
identified with the basis of the vector space V, whereby 
the delta set of the ideal I of a type 61 becomes 
A(I)= {(0,0), (1,0), (0,1), (2,0), (1,1), (0,2)} 
10 The lattice points encircling these are 

(0,3), (1,2), (2,1), (3,0)} . Thus, the Groebner basis of the 
ideal I of a type 61 takes the following form. 

The Groebner basis of the ideal of a type 61= 
{x 3 +a 6 Y 2 -fa5XY4-a 4 X 2 +a3Y+a2X+ai,X 2 Y-f-b 6 Y 2 +b5XY+b4X 2 +b3Y+b2X+b 1 , 

15 XY 2 + C 6 Y 2 + C5XY + C 4 X 2 + C3Y + C2X+C;l} 

These three polynomials correspond to the lattice 
points (3,0), (2,1), and (1,2) respectively (The lattice 
point (0,3) corresponds to the defining equation F) . As a 
rule, six monomials 1, X, Y, X 2 , XY, and Y 2 are not always 

20 linearly independent at the six points that the ideal I 
represents, i.e. in the vector space V. 

So, next, we study the case in which five monomials 
from the beginning in the C34 order 1, X, Y, X 2 , and XY are 
linearly independent in V, and the sixth monomial Y 2 is 

25 represented by a linear combination of them. By assumption, 
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A (I) is a convex set of order 6 that includes 
{(0,0), (1,0), (0,1), (2,0), (1,1)} , and does not include 
(2,0). Thus, it becomes either of A(I) = 

{(0,0), (1,0), (0,1), (2,0), (1,1), (2,1)}, or A(I)= { (0,0) , 
5 (1,0), (0,1), (2,0), (1,1), (3,0)} . When A (I) is the former, 
call I an ideal of a type 62, and in the event that it is 
the latter, call I an ideal of type 63. 

The lattice point set encircling A (I) is 
{ (0,2) , (3,0) } when I is of type 62, and is 
10 (0,2) , (2, 1) , (4, 0) } when I is of type 63. Thus, the 

Groebner basis becomes the following. The Groebner basis 
of the ideal of a type 62= 

{Y 2 +a 5 XY+a 4 X 2 +a3Y+a2XH-ai, X 3 -fb 5 XY+b 4 X 2 +b 3 Y+b2X+b 1 } 

These two polynomials correspond to the lattice points 
15 (0,2), and (3,0) respectively. 

The Groebner basis of the ideal of a type 63= 
{Y 2 +a 5 XY+a 4 X 2 +a3Y+a2X+ai, X 2 Y+b 6 X 3 +b5XY+b4X 2 +b 3 Y+b2X-fbi} 

These two polynomials correspond to the lattice points 
(0,2), and (2,1) respectively. 
20 Although the polynomial, which corresponds to the 

lattice point (4,0), originally exists in the Groebner 
basis of the ideal of a type 63; it was omitted since from 
the defining equation F, and an equation 

f=Y 2 +a 5 XY+a 4 X 2 +a 3 Y+a2X+a 1 that corresponds to the lattice 
25 point (0,2), it can be immediately calculated as F-Yf. 



Next, suppose four monomials from the beginning 1, X, 
Y, and X 2 are linearly independent in V, and that the 
fifth monomial XY is represented by a linear combination 
thereof. That is, A (I) includes 
{(0,0), (1,0), (0,1), (2,0)} , and does not include 
(1,1). Here, assume A (I) does not includes (0,2), then 
there is no other choice but 

A(I) = (0,0),(1,0),(0,1),(2,0),(3,0),(4,0)} so that A (I) 
has order 6. As it is, by assumption, I includes a 
polynomial f=Y 2 +... of which the leading term is Y 2 . As a 
result, (4,0) does not belong to A (I) because Yf-F=X 4 +... 
belongs to I. That is contradictory. From the foregoing, 
it can be seen that A (I) is sure to include (0,2), then 
A(I)= {(0,0), (1,0), (0,1), (2,0), (0,2), (3,0)} . At this time, 
call I an ideal of a type 64. 

The lattice point set encircling the delta set A (I) 
of the ideal I of a type 64 is { (0, 3) , (1, 1) , (4, 0) } . Thus 
the Groebner basis of the ideal I of a type 64 becomes the 
following . 

The Groebner basis of the ideal of a type 64= 
{XY+a 4 X 2 +a 3 Y+a2X+ai,X 4 +b6X 3 +b5Y 2 +b 4 X 2 +b3Y+b 2 X4-bi} 

These two equations correspond to the lattice points 
(1,1), and (4,0) respectively (The lattice point (0,3) 
corresponds to the defining equation F) . 

Next, suppose three monomials from the beginning 1, X, 
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and Y in the C 34 order are linearly independent in V=R/I, 
and that the fourth monomial X 2 is represented by a linear 
combination thereof. At this time, since a polynomial f of 
which the leading term is X 2 is included in the ideal I, 
5 the delta set becomes 

A(I)= {(0,0), (1,0), (0,1), (1,1), (0,2), (1,2)} 
and the lattice point set encircling these becomes 

{(0,3), (2,0)} , whereby I becomes a monomial ideal to be 
generated in f. At this time, call I an ideal of a type 65. 
10 The Groebner basis of the ideal of a type 65= 

{x 2 +a 3 Y+a 2 X+ai} 

The above equation corresponds to the lattice point 
(2,0) (The lattice point (0,3) corresponds to the defining 
equation F) 

15 There is no possibility that, from deg ( ( f ) 0 ) =-v poo 

(f)=4<6, the polynomial f of which the leading term is (a 

term equal to or lower than) Y disappears simultaneously 

at six points that correspond to the ideal I of order 6. 

Thus, three monomials 1, X, and Y from the beginning are 
20 always linearly independent in V=R/I, and above, the 

classification of the ideal of order 6 was completed. 

(Ideal of order 5) 

Suppose I is an ideal of order 5 of coordinate ring R. 

The ideal of order 5 is also classified into a type 51 to 
25 a type 54 similarly to the ideal of order 6, as mentioned 
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below. 

The Groebner basis of the ideal of a type 51= 

{Y 2 +a 5 XY+a4X 2 +a3Y+a2X+a 1 ,X 3 +b5XY-fb 4 X 2 -hb3Y+b 2 X+bi f 
X 2 Y+c 5 XY+c 4 X 2 + c 3 Y+c 2 X+Ci} 
5 The Groebner basis of the ideal of a type 52= 

{XY+a 4 X 2 +a 3 Y+a 2 X+a 1<r Y 2 +b 4 X 2 +b 3 Y+b 2 X+bi} 

The Groebner basis of the ideal of a type 53= 

{XY+a 4 X 2 +a3Y+a2X+a 1 ,X 3 +b5Y 2 +b4X 2 +b3Y+b 2 X+bi} 

The Groebner basis of the ideal of a type 54= 
10 {x 2 +a 3 Y+a 2 X+ai, XY 2 +b 5 Y 2 +b 4 XY+b 3 Y+b 2 X+bi} 
(Ideal of order 4) 

The ideal I of order 4 is also classified into a type 
41 to a type 44 similarly, as mentioned below. 

The Groebner basis of the ideal of a type 41= 
15 {XY+a 4 X 2 +a 3 Y+a 2 X+a 1 , Y 2 +b 4 X 2 +b 3 Y+b 2 X+b 1/ X 3 -f c 4 X 2 + c 3 Y+c 2 X+c 1 } 

The Groebner basis of the ideal of a type 42= 
{x 2 +a 3 Y+a 2 X+a;L, XY+b 3 Y+b 2 X+bil 

The Groebner basis of the ideal of a type 43= 
{x 2 +a 3 Y+a 2 X+ai, Y 2 +b 4 XY+b 3 Y+b 2 X+bi} 
20 The Groebner basis of the ideal of a type 44= 

{Y+a 2 X+ail 
(Ideal of order 3) 

The ideal I of order 3 is also classified into a type 
31 to a type 33 similarly, as mentioned below. 
!5 The Groebner basis of the ideal of a type 31- 



{X 2 +a 3 Y+a 2 X+ai, XY+b 3 Y+b 2 X+bi, Y 2 +c 3 Y+c 2 X+Ci) 

The Groebner basis of the ideal of a type 32 = 
{Y+a 2 X+ai, X 3 +b 3 X 2 +b 2 X+bi} 

The Groebner basis of the ideal of a type 33= {x+ai} 
(Ideal of order 2) 

The ideal I of order 2 is also classified into a type 
21 and a type 22 similarly, as mentioned below. 

The Groebner basis of the ideal of a type 21= 
{Y+a 2 X+ai, X 2 +b 2 X+bi} 

The Groebner basis of the ideal of a type 22= 
{x+a x , Y 2 +b 2 Y+bi} 
(Ideal of order 1) 

Needless to say, the ideal of order 1 is only of type 
11, as mentioned below. 

The Groebner basis of the ideal of a type 11= 
{X+ai, Y+bi} 
[Remark] 

Ideals of a type 65, 44, and 33 among the ideals 
mentioned above, which are a principal ideal, represent a 
unit element as a Jacobian group element. Also, the 
reduced ideal types among the ideal types mentioned above 
are only 31, 21, 22, and 11. For example, the reason why 
the ideal of a type 32 is not a reduced one is understood 
in a manner mentioned below. 

Suppose I is an ideal of a type 32, then fi=Y+a 2 X+ai, 



- 17 - 



thus 5 (I*)=-v co (f I ) - 5 (I) =4-3=1, thus, f i*=X+a ' , and 5 
(I**)=-v co (f I *)-5 (I*)=3-l=2 because I* is of type 11. The 
order thereof is different, whereby I=£l**. 
[additive algorithm on Jacobian group of the C 34 curve, 
5 part 2] 

Set the coordinate ring of the C 34 curve C defined 
over a field k having the defining equation F to 
R=k[X,Y]/F. Now let the additive algorithm 1 take concrete 
shape more clearly for estimating its execution speed. 

10 However, hereinafter, the order of the field k is supposed 
to be sufficiently large in consideration of an 
application to the discrete logarithmic cryptography. 
(Composition operation 1) 

At first, study a first step of the additive algorithm 

15 1 for different ideals Ii and I 2 , which is hereinafter 

referred to as a composition operation 1. That is, f j is 
to be found for an ideal product J=I 1 • I 2 . To this end, the 
Groebner basis of the ideal product J should be found 
(since fj is its first element) . The genus of the C 34 curve 

20 is 3, whereby the order of the ideal II or 12 is equal to 

or less than 3. Thus, its type is anyone of 11, 21, 22, 31, 
and 32. The case is mentioned here in which both of the 
ideals Ii and I 2 are of type 31; however the other case is 
also similar. 

25 We can Suppose I x and I 2 are selected at random from 



the Jacobian group, Then we have at almost every case, 

V(Ii) nv(I 2 ) = * (1) 
Because the order of the field k is supposed to be 
sufficiently large. Here for the ideal I, a set of zero of 
I is denoted by V(I) ( <f> represents an empty set). Also in 
the event that the condition (1) is not met, upon 
generating element R x and R 2 that yields Ri+R 2 =0, and 
calculating di+Ri) + (I 2 +R 2 ) instead of (Ii + I 2 ), then it 
boils down to the case in which the condition (1) holds. 
Also, the case is very rare (a probability of 1/q or 
something like it when the size of the defining field k is 
taken as q) in which the condition (1) is not met, whereby 
only the case in which the condition (1) is met should be 
considered in evaluating efficiency of the algorithm. 
Thereupon, hereinafter, assume that l x and I 2 meet the 
condition (1) . 

Suppose J=I X I 2 is a product of I x and I 2 in R. I x and I 2 
are both ideals of order 3, whereby the order of J becomes 
6. Thus, the type of J is anyone of 61, 62, 63, 64, and 65. 
So as to decide which the type of J is, a linear relation 
should be found in a residue ring R/J among ten monomials 
1, X, Y, X 2 , XY, Y 2 , X 3 , X 2 Y, XY 2 , and X 4 (2) 

An ideal I ± (i=l,2) is of type 31, whereby 
[EQ. 1] 

R/lj =k.10k-X®k-Y 
m vll? 
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From the condition (1), it follows that 
[EQ. 2] 

R/J = R/^ 9R/I 2 = ©* =1 k 
m (mmod^), mmod(l 2 )) »-» v{J : vj^ 

where v (1) m :v (2) m is a six-dimensional vector over k to be 
5 obtained by connecting two vectors v (1) m(i=l, 2) . Thus, so 
as to find a linear relation in R/J among ten monomials iru 
in the equation (2), an intra-row linear relation of the 
following 10x6 matrix M c should be found with vectors 
v (1> m i : v (2> m i ( i=l , 2 , 10 ) taken as a row. 
10 [EQ. 3] 
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As well known, the intra-row linear relation of the 
matrix M c is obtained by triangulating a matrix M c with 
row-reducing transformation, and this allows a type of the 
15 ideal J and its Groebner basis to be obtained. The details 
will be described in embodiments. 
(Remark) 



In the event that the condition (1) does not hold for 
the ideals Ii and I 2 , the rank of the matrix M c becomes 
equal to or less than 5. In calculating the ideal product 
of Ii and I 2 , at first, assume that they meet the 
condition (1) for calculation, and as a result of the row- 
reducing transformation, if it becomes clear that the rank 
of the matrix M c is equal to or less than 5, then the 
elements Ri and R 2 that yields Ri+R 2 =0 should be generated 
to calculate (Ii+Ri) + (I 2 +R 2 ) instead of Ii+I 2 . 
(Composition operation 2) 

Now study a first step of the additive algorithm 1 for 
the same ideals Ii =1, and I 2 =I of the coordinate ring 
R=k[X,Y]/F, which is hereinafter referred to as a 
composition operation 2. That is, for an ideal product 
J=I 2 , its Groebner basis is to be found for calculation of 
fj. The case is mentioned in which the ideal I is of type 
31; however the other case is also similar. The order of 
the field k is supposed to be sufficiently large, whereby 
no multiple point exists in V(I) in almost every case. 
(3) 

Also, in evaluating efficiency of the algorithm, only 
the case should be considered in which the condition (3) 
is met. Hereinafter, assume that I meets the condition (3) . 
J=I is still an ideal of order 6, whereby, so as to 
calculate its Groebner basis, a linear relation should be 
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found in the residue ring R/J among the monomials of the 
equation (1) . The ideal I is of type 31, whereby 
[EQ. 4] 



R/l = k10kX©kY 
m h-> v. 



m 



5 Also, from the condition (3) , the necessary and 

sufficient condition for causing the polynomial f (6R) to 

belong to J=I 2 is 

fSl,f x F Y -f Y F x EI 

(Here, for the polynomial f, f x denotes a differential of 
10 f with regard to X. As to f Y as well, the matter is 
similar . ) Thus, 
[EQ - 5] 

R/J s R/I0R/I = ©f =1 k 
m i ► (mmod(l), m x F Y -m Y F x mod(l)) ~ v m : v^.^ 

Where, v m : v (mX fy-ihy fx) is a six-dimensional vector over k 
15 to be obtained by connecting two vectors v m and v (mX F Y-mY fx) - 
After all, so as to find the above-mentioned linear 
relation, for ten monomials m± in the equation (1), a 
intra-row linear relation should be found of the following 
10x6 matrix M D mentioned below with a six-dimensional 
20 vector v m i:v {mix FY - m iY fx) over k taken as a row. 
[EQ. 6] 



v. : 0 



V X 2 : V (2F Y X) 



V 



XY 



(-F X X+F Y Y) 



M c = 




(-2F X Y) 



X 3 * (3F Y X 2 ) 
V X 2 Y " V (-F X X 2 +2F Y XY) 



V 



XY 



(-2F X XY+F Y Y 2 ) 



V 



(4F Y X 3 ) 



From now on, upon triangulating the matrix M D with the 
row-reducing transformation, the type of the ideal J and 
its Groebner basis can be obtained similarly to the 
composition operation 1. 
(Remark) 

In the event that the condition (3) does not hold for 
the ideal I, the rank of the matrix M D becomes equal to or 
less than 5. In calculating the Groebner basis of I 2 , at 
first, assume that it meets the condition (3) for 
calculation, and as a result of the row-reducing 
transformation, if it becomes clear that the rank of the 
matrix M D is equal to or less than 5, then elements R x and 
R 2 that yields Ri+R 2 = 0 should be generated to calculate 
(I+Ri) + (I+R 2 ) instead of I + I. 
(Reduction operation) 

Now study a second step (and a third step) of the 
additive algorithm 1, which is hereinafter referred to as 
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a reduction operation. That is, for the ideal J of which 
the order is equal to or less than 6, the Groebner basis 
of J*=fj:J is to be found. The case is mentioned below in 
which J is of type 61; however the other case is also 
5 similar. 

J is of type 61, whereby its Groebner basis can be 
expressed by 

{f j=X 3 +a 6 Y 2 +..., g=X 2 Y+b 6 Y 2 +..., h=XY 2 +c 6 Y 2 -K..} 
By definition, J*=fj:J, whereby 5 ( J* ) =-Voo ( f j) - 6 (J) =3. 
10 Thus, it can be seen that J* becomes an ideal of a type 31 
because J* is a reduced ideal. Thus so as to find its 
Groebner basis, for the monomial mi in 
1, X, Y, X 2 , XY, and Y 2 (4) 

a linear relation Sidimi should be found in which 2 idling 
15 and Zidjiriih become zero simultaneously in R/fj . 

From LM(F)=Y 3 ,LM(fj)=X 3 , then 
[EQ. 7] 

R/fjR = k- iek Xek Yek X2©k XY0k Y2ek. X 2 Y 0 k ■ XY2 e k • X 2 Y2 

f Wj 

whereby, so as to find the above-mentioned linear relation, 
20 for each of six monomials m± in the equation (4), an 

intra-row linear relation should be found of the following 
6x18 matrix M R with a 18-dimensional vector w (mi g) : w (m i h) 
over k to be obtained by connecting two vectors w (Itl i g) and 
W(mi h) taken as a row. 
2 5 [EQ. 8] 
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M R = 





: W h 


W X g 


: w Xh 


WYg 


: w Yh 




: w X2h 


W XY g 


: w XYh 


, w Y*g 


: w Y2h 



From now on, upon triangulating the matrix M R with the 
row-reducing transformation, the Groebner basis of the 
ideal J* can be obtained. However, as matter of fact, in 
5 almost every case, it is enough to triangulate not the 
matrix M R itself but a certain submatrix M r of its 6x3. 
This will be described in details in the next chapter. 
(Arithmetic quantity of algorithm) 

An arithmetic quantity of the algorithm will be 

10 evaluated. Set the order of the defining field to q, then 
a random element of the Jacobian group is represented by 
the ideal of a type 31 apart from an exception of a 
probability of 1/q. Also, the result of the composition 
operations 1 and 2 for the ideal of a type 31 demonstrates 

15 that it becomes an ideal of a type 61 apart from an 

exception of a probability of 1/q. Thus, so as to evaluate 
the arithmetic quantity of the algorithm, the arithmetic 
quantity of the composition operations 1 and 2 at the time 
of having input the ideal of a type 31, and the arithmetic 

20 quantity of the reduction operation at the time of having 
input the ideal of a type 61 or a type 31 should be 
evaluated. Also, the arithmetic quantity of the algorithm 
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is represented below with the number of the times of 
multiplication and reciprocal arithmetic. 

At first, the arithmetic quantity of the composition 
operation 1 is examined. Suppose that Ii and I 2 are ideals 
of type 31: then 

Ii= {X 2 +a 3 Y+a 2 X+a!,XY+b 3 Y+b 2 X+bi, Y 2 +c 3 Y+c 2 X+ci} 
I 2 = {x 2 + s 3 Y+s 2 X+s 1/ XY+t 3 Y+t 2 X+ti, Y 2 +u 3 Y+u 2 X+U!} 
For the ideals Ix and I 2 , the matrix M c is expressed by 



M, 



[EQ 


• 9] 














f 


1 


0 


0 


1 


0 


0 






0 


1 


0 


0 


1 


0 






0 


0 


1 


0 


0 


1 








" a 2 




"Si 


-s 2 


" S 3 






"b, 


" b 2 


" b 3 


-tl 




-t 3 


c = 






-c 2 






-u 2 


~ U 3 






a l a 2 a 3 b 1 


-a., + a| + a 3 b 2 


a 2 a 3 + a 3 b 3 


S 1 S 2 4- S 3 t| 


-S, + + S 3 t 2 


s 2 s 3 + s 3 t 3 






3 2 b 1 +a 3 C 1 


a 2 b 2 + a 3 c 2 


~ a i + a 2 b 3 + a 3 C 3 


S 2*1 +S 3 U 1 


s 2 t 2 + s 3 u 2 


-s, +s 2 t 3 +s 3 u : 






b 1 b 2 +b 3 C 1 


b 2 + b 3 C 2 


-bl + b 2 b 3 + b 3 C 3 


t,t 2 +t 3Ul 


*2 +t 3 U 2 


-*1 +t 2 t 3 +t 3 u 3 




< 


e !0,1 


e i0,2 


e i0,3 


e i0,4 


e i0.5 


e 10.6 



where, 

eio, i=ai 2 -aia 2 2 -2a 2 a 3 bi"a3 2 ci 
eio,2 == 2aia 2 -a 2 3 -2a 2 a 3 b 2 -a 3 2 c 2 
^io, 3 = 2aia 3 -a2 2 a 3 -2a 2 a 3 b 3 ~a 3 2 c 3 
eio,4 =si 2 -sis 2 2 -2s 2 s 3 ti-s 3 2 ui 
ei 0/ 5 =2sis 2 -s 2 3 -2s 2 s 3 t 2 -s 3 2 u 2 
ei 0/6 =2sis 3 -s 2 2 s 3 -2s 2 s 3 t 3 -s 3 2 U3 

From this, it can be seen that upon eliminating 
multiplicity successfully, the matrix M c can be 
constructed with at most 44-times multiplication. 
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Upon paying attention to the fact that the row- 
reduction transformation for the matrix M c 1 takes a 
formula having the first row to the third row thereof 
already row-reduction, and that its component is 0 or 1, 
it can be executed with three-times division and at most 
6x6+6x5+6x4=90-times multiplication. From the foregoing, 
the arithmetic quantity of the composition operation 1 is 
at most three-times reciprocal arithmetic, and 134-times 
multiplication. Similarly, it can be seen that the 
arithmetic quantity of the composition operation 2 is at 
most three-times reciprocal arithmetic, and 214-times 
multiplication. The arithmetic quantity is increased by 
the extent to which the matrix M D is more complex than M c . 

Next, the arithmetic quantity of the reduction 
operation at the time of having input the ideal of a type 
61 is examined. Suppose J is an ideal of type 61: then 
J= {x 3 +a 6 Y 2 +a 5 XY+a4X 2 -fa3Y+a2X+ai, 
X 2 Y+b 6 Y 2 +b 5 XY+b 4 X 2 +b3 Y+b 2 X+bi , 
XY 2 +c 6 Y 2 + c 5 XY+C4X 2 + C3Y+C2X+c 1 } 

A 6x3 minor M r obtained by taking a seventh column to 
a ninth column of the matrix M R for the ideal J becomes 
[EQ. 10] 
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< 1 
-a 4 - a 5 a 6 + b 5 

b 4 +3 5 b 6 
e 4,1 



V 



'5,1 
>6,1 



a 5 " a i + b e 
b 5 + a R b 



6^6 



; 4,2 



'5,2 
} 6,2 



-a„ - 



0 ^ 

0 

1 

-a 5 - a§ + b 6 
2a 5 a 6 -a|+b 5 +a 6 b 6 



'6,3 



) 



10 



where 

2 2 2 

e 4 ,i=-a2+a4 -a 3 a6+3a4asa 6 +a5 a6 +b3-a5b 4 -a4b5-a 5 a6b5 

2 2 3 2 

€4,2=-a3+ a 4a5+a 5 a6+2a 4 a 6 +a 5 a6 -a 6 b 4 -a5b 5 -a6 bs 

es, i=-2a3a5+2a4a5 2 -a2a6+a4 2 a6+a5 3 a6-a3a6 2 +3a4a5a6 2 +a5 2 a6 3 +b2-a 4 b4- 
a5a6b4+a3b6-2a 4 a 5 b6-a5 a 6 b 6 

e 5/2 =-a2+a5 3 -2a3a 6 +2a4a5a 6 +2a5 2 a6 2 +2a4a6 3 +a 5 a6 4 +b3-a5b4-a6 2 b4-a5 2 b6- 



a4a6b6-asa6 2 b6 



e6,i == -2a 3 a4-2a 2 a5+3a4 a5-4a 3 a5a6+6a4a 5 a 6 -a 2 a 6 +a 4 a 6 + 2a 5 a 6 - 
a3a6 3 +3a4a5a6 3 +a5 2 a6 4 +a5b3+a3b5-2a4a5b5-a5 2 a 6 b5+a2b6-a4 2 b 6 +a 3 a6b6-- 



3_ 2 



2 2 

3a 4 a5a6b6~a5 a6 be 



2_ 3 



e 6 ,2 == -2a3a5+2a 4 a5 -2a 2 a 6 +a 4 a 6 +2a 5 a 6 -3a 3 a 6 + 5a 4 a 5 a 6 +3a 5 a 6 
+ 2a 4 a6 4 +a5a6 5 +b2+a6b3-a5 2 b5-a 4 a6b5-a5a6 2 b5-fa 3 b 6 -a 4 a5b6-a5 2 a6b6- 

2a4a6 2 b 6 ~a 5 a6 3 b6 

15 e 6/ 3=-a5 2 -2a 4 a6-3a 5 a6 2 -a 6 4 +b 4 +a6b5+a5b6+a 6 2 b 6 

This leads to the result that, if a (2,2) component 
d=-a 5 -a 6 2 +b 6 of the matrix M r is not zero, the rank of the 
matrix M r becomes 3. Thus, when d^O, instead of the 6x18 
matrix Mr, the 6x3 matrix M r should be employed that is 

20 its minor. It is acceptable to let d^O in evaluating 

efficiency of the algorithm because the probability of d=0 
is considered to be 1/q or something like it. From the 
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above equation, it can be seen that upon eliminating 
multiplicity successfully, the matrix M r can be 
constructed with at most 40-times multiplication. Upon 
paying attention to the fact that the matrix M r is already 
5 a triangle matrix, and that (1,1) and (3,3) components 
thereof are 1, it can be seen that the row-reduction 
transformation for the matrix M r ' can be executed with at 
most one-time reciprocal arithmetic and 2x4+2x3=14-times 
multiplication. From the foregoing, the arithmetic 

10 quantity of the reduction operation at the time of 

inputting the ideal of a type 61 is at most one-time 
reciprocal arithmetic and 54-times multiplication. Also at 
the time of inputting the ideal of a type 31, from the 
similar consideration, it can be seen that the reduction 

15 operation requires most one-time reciprocal arithmetic and 
16- times multiplication . 

Upon summarizing the foregoing, it follows that the 
arithmetic quantity of the additive algorithm on Jacobian 
group of the present invention is one as shown in Fig. 16. 

20 In Fig. 16, I and M represent the reciprocal arithmetic 

and the multiplication respectively. On the elliptic curve, 
the addition (of different elements) can be executed with 
one-time reciprocal arithmetic and three-times 
multiplication, and the arithmetic of two-times multiple 

25 can be executed with one-time reciprocal arithmetic and 
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four-times multiplication. However , so as to obtain a 
group of the same bit length, the bit length of the finite 
field requires three times as large arithmetic quantity as 
the case of the C34 curve does. Suppose that the 
5 arithmetic quantity of the reciprocal arithmetic is twenty 
times as large as that of the multiplication, and that the 
arithmetic quantity of the reciprocal arithmetic and the 
multiplication is on the order of a square of the bit 
length, then it can be seen that the addition on the C34 
10 curve can be executed with 304/(23x9)^1.47 times as large 
arithmetic quantities as that on the elliptic cure can be 
done, and the arithmetic of two-times multiple 384/(24x9) 
^1.78 times. 

15 BRIEF DESCRIPTION OF THE DRAWING 

This and other objects, features and advantages of the 
present invention will become more apparent upon a reading 
of the following detailed description and drawings, in 
which: 

20 Fig. 1 is a block diagram illustrating an embodiment 

of the present invention; 

Fig. 2 is a functional block diagram of an ideal 
composition section ; 

Fig. 3 is a functional block diagram of an ideal 
25 reduction section; 



Fig. 4 is one specific example of an algebraic curve 
parameter file A for the C 34 curve; 

Fig. 5 is one specific example of an ideal type table 
for the C34 curve; 

Fig. 6 is one specific example of a monomial list 
table for the C 34 curve; 

Fig. 7 is one specific example of a table for a 
Groebner basis construction for the C 34 curve; 

Fig. 8 is one specific example of the algebraic curve 
parameter file for the C 2 i curve; 

Fig. 9 is one specific example of the ideal type table 
for the C 2 7 curve; 

Fig. 10 is one specific example of the monomial list 
table for the C 2 7 curve; 

Fig. 11 is one specific example of the table for a 
Groebner basis construction for the C 2 7 curve; 

Fig. 12 is one specific example of the algebraic curve 
parameter file for the C25 curve; 

Fig. 13 is one specific example of the ideal type 
table for the C25 curve; 

Fig. 14 is one specific example of the monomial list 
table for the C25 curve; 

Fig. 15 is one specific example of the table for a 
Groebner basis construction table for the C25 curve; and 

Fig. 16 is a table illustrating the arithmetic 
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quantity of the additive algorithm on Jacobian group in 
accordance with the present invention. 

DESCRIPTION OF THE EMBODIMENT 

5 Embodiments of the present invention will be explained 

below in details by employing the accompanied drawings. 
Fig. 1 is a functional block diagram of the embodiment of 
the present invention, and the Fig. 2 is a block diagram 
illustrating an example of the ideal composition section 
10 of Fig. 1. Fig. 3 is a block diagram illustrating an 

example of a first and a second ideal reduction section of 
Fig. 1. 

At first, the embodiment of the case in which the C34 
curve was employed is shown. In this embodiment, the 

15 algebraic curve parameter file of Fig. 4 is employed as an 
algebraic curve parameter file, the ideal type table of 
Fig. 5 as an ideal type table, the monomial list table of 
Fig. 6 as an monomial list table, and the table for a 
Groebner basis construction of Fig. 7 as a table for a 

20 Groebner basis construction respectively. 

In a Jacobian group element adder of Fig. 1, suppose 
the Groebner bases 

I 1= {x 2 +72 6Y+8 3 6X+355,XY+36Y+4 2 8X+4 77, Y 2 +7 64 Y+42 5X+8 65} 
and 

2 5 I 2 = {X 2 + 838Y+7 8 4X+97,XY+602Y+4 50X+2 91, Y 2 + 50 6Y+524X+4 97 } 
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were input of the ideal of the coordinate ring of the 
algebraic curve designated by an algebraic curve parameter 
file A, which represents an element of the Jacobian group 
of the C 34 curve designated by an algebraic curve 
5 parameter file A 16 and an algebraic curve parameter file 
A of Fig. 4 . 

At first, an ideal composition section 11, which takes 
the above-mentioned algebraic curve parameter file A, and 
the above-mentioned Groebner bases Ii and I2 as an input, 

10 operates as follows according to a flow of a process of 

the functional block shown in Fig. 2. At first, the ideal 
composition section 11 makes a reference to an ideal type 
table 25 of Fig. 5 in an ideal type classification section 
21 of Fig. 2, retrieves a record in which the ideal type 

15 described in an ideal type field accords with the type of 
the input ideal Ii for obtaining a fourteenth record, and 
acquires a value Ni=31 of an ideal type number field and a 
value di=3 of an order field of the fourteenth record. 

Similarly, the ideal composition section 11 retrieves 

20 a record in which the ideal type accords with the type of 
the input ideal I 2 for obtaining the fourteenth record, 
and acquires a value N 2 =31 of the ideal type number field 
and a value d 2 =3 of the order field of the fourteenth 
record. 

25 Next, the ideal composition section 11 calculates the 
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sum d 3 =di+d 2 =6 of said values di=3 and d 2 =3 of said order 
field in a monomial vector generation section 22 , makes a 
reference to a monomial list table 26, retrieves a record 
of which the value of the order field is said d3=6 for 
5 obtaining a first record, and acquires a list 1, X, Y, X 2 , 
XY, Y 2 , X 3 , X 2 Y, XY 2 , and X 4 of the monomial described in 
the monomial list field of the first record. 

Ii and I2 are different, whereby a remainder to be 
attained by dividing Mi by Ii for each of M± (K=i<=10) in 

10 said list 1, X, Y, X 2 , XY, Y 2 , X 3 , X 2 Y, XY 2 , and X 4 of said 
monomial is calculated to obtained a polynomial 
a (l> i+a U) 2 X+a (:L) 3Y, to arrange its coefficients in order of 
the monomial order 1, X, Y, ... of the algebraic curve 
parameter file A, and to generate a vector (a (1) i, a U) 2/ a u> 3) • 

15 Furthermore, a remainder to be attained by dividing M ± by 
I 2 is calculated to obtain a polynomial b U) i+b U) 2 X+b (l) 3Y, 
to arrange its coefficients in order of the monomial order 
1, X, Y, ... of the algebraic curve parameter file A, to 
generate a vector (b (1) 1, b U) 2 , b {1) 3 ) r and to connect the 

20 above-mentioned two vectors for generating a vector v±= 

That is, divide Mi=l by Ii: then 
1=0 • (X 2 +726Y+836X+355) +0 • (XY+36Y+428X+477 ) +0 • 
(Y 2 +746Y+425X+865) +1 
25 whereby, 1 is obtained as a remainder to generate a vector 
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(1,0,0), Divide M x =l by I 2 : then 

1=0 - (X 2 +838Y+784X+97) +0 • (XY+602Y+4 50X+2 91 ) +0 • 
(Y 2 +506Y+524X+497) +1 

whereby, 1 is obtained as a remainder to generate a vector 
5 (1,0,0). These two vectors are connected to generate a 
vector vi= (1, 0, 0, 1, 0, 0) . 

Next, divide M 2 =X by Ii: then 
X=0 • (X 2 +726Y+836X+355) +0 • (XY+36Y+428X+477 ) +0 • 
(Y 2 +7 4 6Y+42 5X+8 65) +X 
10 whereby, X is obtained as a remainder to generate a vector 
(0,1,0). Divide M 2 =X by I 2 : then 

1=0- (X 2 +838Y+784X+97) +0 • (XY+602Y+450X+291 ) +0 • 
(Y 2 +506Y+52 4X+4 97) +X 

whereby, X is obtained as a remainder to generate a vector 
15 (0,1,0). These two vectors are connected to generate a 

vector v 2 = (0, 1, 0, 0, 1, 0) . 

Next, divide M 3 =Y by Ii: then 

Y=0 • (X 2 +726Y+836X+355) +0 • (XY+36Y+428X+477 ) +0 • 

(Y 2 +7 4 6Y+42 5X+8 65) +Y 
20 whereby, Y is obtained as a remainder to generate a vector 

(0,0,1). Divide M 3 =Y by I 2 : then 

Y=0 • (X 2 +838Y+784X+97) +0 • (XY+602Y+450X+291 ) +0 • 
(Y 2 +5 0 6Y+52 4X+4 97) +Y 

whereby, Y is obtained as a remainder to generate a vector 
25 (0,0,1). These two vectors are connected to generate a 
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vector v 3 = (0, 0, 1, 0, 0, 1) . 

Next, divide M 4 =X 2 by I x : then 
X 2 =l • (X 2 +726Y+836X+355) +0 • (XY+36Y+428X+477 ) +0 • 
(Y 2 +7 4 6Y+42 5X+8 65) +654+17 3X+2 8 3Y 
5 whereby, 654+173X+283Y is obtained as a remainder to 

generate a vector (654,173,283). Divide M 4 =X 2 by I 2 : then 
X 2 =l • (X 2 +838Y+784X+97) +0 • (XY+602Y+450X+291) +0 • 
(Y 2 +50 6Y+52 4X+4 97) +912+22 5X+171Y, 

whereby, 912+225X+171Y is obtained as a remainder to 
10 generate a vector (912,225,171). These two vectors are 

connected to generate a vector 

v 4 = (654, 17 3, 28 3, 912, 225, 171) . 

Next, divide M 5 =XY by Ii: then 

XY=0 • (X 2 + 726Y+836X+355) +1 • (XY+36Y+428X+477 ) +0 • 
15 (Y 2 +7 4 6Y+42 5X+8 65) +532+58 1X+97 3Y 

whereby, 532+58 1X+973Y is obtained as a remainder to 

generate a vector (532,581,973). Divide M 5 =XY by I 2 : then 

XY=0 • (X 2 + 838Y+784X+97) +1 • (XY+602Y+450X+2 91 ) +0 • 

(Y 2 +50 6Y+52 4X+4 97) +718+559X+407Y, 
20 whereby, 718+559X+407Y is obtained as a remainder to 

generate a vector (718,559,407). These two vectors are 

connected to generate a vector 

v 5 = (532, 581, 973, 718, 559, 407) . 

Next, divide M 6 =Y 2 by Ii: then 
25 Y 2 =0 • (X 2 +726Y+836X+355) +0 ■ (XY+36Y+428X+477 ) +1 • 
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(Y 2 +7 4 6Y+4 25X+8 65) + 14 4+58 4X+2 63Y, 

whereby, 144+584X+263Y is obtained as a remainder to 
generate a vector (14 4, 584, 263). Divide M 6 =Y 2 by I 2 : then 
Y 2 =0 • (X 2 +838Y+784X+97) +0 • (XY+602 Y+4 50X+2 91 ) +1 • 
5 (Y 2 +50 6Y+524X+4 97) +512+4 8 5X+503Y, 

whereby, 512+485X+503Y is obtained as a remainder to 
generate a vector (512,485,503). These two vectors are 
connected to generate a vector 
v 6 = (14 4, 58 4, 2 63, 512, 4 8 5, 503) . 
10 Next, divide M 7 =X 3 by Ii: then 

X 3 =(173+X) • (X 2 +726Y+836X+355) +283 • (XY+36Y+428X+477 ) +0 • 
(Y 2 +7 4 6Y+42 5X+8 65) +34 9+2 69X+4 2 9Y, 

whereby, 34 9+2 69X+42 9Y is obtained as a remainder to 
generate a vector (349,269,429). Divide M 7 =X 3 by I 2 : then 
15 X 3 =(255+X) • (X 2 + 838Y+784X+97) +171 • (XY+602Y+450X+291 ) +0 • 
(Y 2 +50 6Y+52 4X+4 97) +53+82 1X+10 9Y, 

whereby, 53+821X+109Y is obtained as a remainder to 
generate a vector (53,821,109). These two vectors are 
connected to generate a vector v 7 = (349, 269, 429, 53, 821, 109) . 
20 Next, divide M 8 =X 2 Y by Ii: then 

X 2 Y=Y • (X 2 + 726Y+836X+355) +173 • (XY+36Y+428X+477 ) +283 • 
(Y 2 +74 6Y+4 2 5X+8 65) +60 9+418X+24 3Y, 

whereby, 609+418X+243Y is obtained as a remainder to 
generate a vector (609,418,243). Divide M 8 =X 2 Y by I 2 : then 
25 X 2 Y=Y • (X 2 + 838Y + 784X+97) +225 • (XY+602 Y+4 50X+2 9 1 ) +17 1 • 
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(Y 2 +50 6Y+524X+4 97) + 8 8 8+8 5 6X+916Y, 

whereby, 888+856X+916Y is obtained as a remainder to 
generate a vector (888,856,916). These two vectors are 
connected to generate a vector 
5 v 8 = (609, 418, 243, 888, 856, 916) . 

Next, divide M 9 =XY 2 by Ii: then 
XY 2 =0 • (X 2 +726Y+836X+355) + (581+Y) • (XY+36Y+428X+477 ) +973 • 
(Y 2 +74 6Y+4 25X+8 65) +1 99+72 OX+4 18 Y, 

whereby, 199+720X+418Y is obtained as a remainder to 
10 generate a vector (199,720,418). Divide M 9 =XY 2 by I 2 : then 
XY 2 =0 • (X 2 +838Y+784X+97) + (559+Y) • (XY+602 Y+4 50X+2 91 ) +4 07 • 
(Y 2 +50 6Y+524X+4 97) +310+33 1X+91Y, 

whereby, 310+331X+91Y is obtained as a remainder to 
generate a vector (310,331,91). These two vectors are 

15 connected to generate a vector v 9 = (199, 720, 418 , 310, 331, 91) . 

Next, divide Mi 0 =X 4 by I3.: then 
X 4 =(313 + 173X+X 2 + 283Y) * (X 2 + 726Y+836X+355) +45 • 
(XY+36Y+428X+477) +378 • (Y 2 +74 6Y+425X+8 65 ) +554+4 98X+143Y 
whereby, 554+4 98X+143Y is obtained as a remainder to 

20 generate a vector (554,498,143). Divide Mi 0 =X 4 by I 2 : then 
X 4 = (78 + 225X+X 2 + 171Y) • (X 2 + 8 38 Y+7 8 4X+ 97 ) +2 66 • 
(XY+602Y+450X+291) +989 • ( Y 2 +50 6Y+524X+4 97 ) +643 + 522X+107 Y, 
whereby, 643+522X+107Y is obtained as a remainder to 
generate a vector (643,522,107). These two vectors are 

25 connected to generate a vector 
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v 10 = (554 , 498, 143, 643, 522, 107) . Above, the process of the 
ideal composition section 11 in the monomial vector 
generation section 22 is finished. 

Next, in a basis construction section 23, the ideal 
5 composition section 11 inputs ten six-dimensional vectors 
vi, v 2 , v 3 , v 4 , v 5 , v 6 , v 7 , v 8 , v 9 , and v 10 generated in the 
monomial vector generation section 22 into a linear- 
relation derivation section 24, and obtains a plurality of 
10-dimensional vectors mi, m2, ... as an output. The linear- 

10 relation derivation section 24 derives a linear relation 
of the vectors, which were input, employing a discharging 
method. The discharging method is a well-known art, 
whereby, as to an operation of the linear-relation 
derivation section 24, only its outline is shown below. 

15 The linear-relation derivation section 24 firstly 

arranges the ten six-dimensional vectors v x , v 2 , v 3 , v 4 , v 5 , 
V6r v 7 , v 8 , V9, and vi 0 , which were input, in order for 
constructing a 10x6 matrix 
[EQ. 11] 
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10 



Next, the linear-relation derivation section 24 
connects a 10-dimensional unity matrix to a matrix M c to 
obtain 

[EQ. 12] 
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Next, the linear-relation derivation section 24 
triangulates a matrix M' c by adding a constant multiple of 
an i-th row to an (i+l)-th (i=l,2, ...6) row to a tenth row 
to obtain the following matrix m- 
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As well known, the vector that is composed of a 
seventh component and afterward of the seventh row to the 



tenth row of the matrix m is a vector 
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{ (mi, i, mi, 2 , ...,mi, n ) , (m 2/ i, m 2/2 , m 2 , n ) / •••) representing a 
linearly-independent linear dependence relation 
2 i 10 mjiVi=0 ( j=l, 2, ...) of all of the ten six-dimensional 
vectors v lf v 2 , v 3 , v 4 , v 5 , v 6 , v 7/ v 8 , v 9 , and vi 0 that were 
5 input. The linear-relation derivation section 2 4 outputs a 
vector mp (28,132,31,271,469,166,1,0,0,0) that is 
composed of the seventh component and afterward of the 
seventh row of the matrix m, a vector 

m 2 = (856, 618, 747, 909, 132, 636, 0, 1, 0, 0) that is composed of 
10 the seventh component and afterward of the eighth row of 
the matrix m, and a vector 

m 3 = (652, 322, 240, 978, 826, 846, 0, 0, 1, 0) that is composed of 
the seventh component and afterward of the ninth row of 
the matrix m, and a vector 

15 m 4 = (333, 346, 980, 935, 824, 614, 0, 0, 0, 1) that is composed of 
the seventh component and afterward of the tenth row of 
the matrix m. Now return to the explanation of the process 
of the ideal composition section 11 in the basis 
construction section 23. 

20 Next, the ideal composition section 11 makes a 

reference to a table 27 for a Groebner basis construction 
of Fig. 7, and retrieves a record, of which the value of 
the order field is said value d 3 =6, and in which a vector 
of which the components that correspond to all component 

25 numbers described in the component number list field are 
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all zero does not lie in said plurality of said vectors 
mi=(28, 132, 31, 271, 4 69, 166, 1,0,0,0), 
m 2 = (856, 618, 74 7, 90 9, 132, 63 6, 0, 1,0,0), 
m 3 = (652, 322, 24 0, 97 8, 82 6, 846, 0,0, 1,0), and 
5 m 4 = (333, 346, 980, 935, 824, 614, 0, 0, 0, 1) . The value of the 

order field of a first record is 6, and a vector, of which 
the component number lists 7, 8, 9, and 10 of the first 
record are all zero, does not lie in the vectors mi, m 2 , rri3, 
and m 4 , whereby the first record is obtained as a 

10 retrieval result 

Furthermore, the value of a first vector type of the 
first record is (*,*,*,*,*,*, 1, 0, 0, 0) (A code * is 
interpreted as representing any number) , which coincides 
with the vector m ± = (28, 132, 31, 271, 469, 166, 1, 0, 0, 0) , 

15 whereby the vector mi is regarded as a column of the 

coefficient of each monomial of the monomial order 1, X, Y, 
X 2 , XY, Y 2 , X 3 , X 2 Y, XY 2 , and X 4 of the algebraic curve 
parameter file A to generate a polynomial 

f i=2 8+132X+31Y+2 71X 2 +4 69XY+16 6Y 2 +X 3 

20 Similarly, the value of a second vector type of the 

first record is (*,*,*,*,*,*, 0, 1, 0, 0) (A code * is 
interpreted as representing any number) , which coincides 
with the vector m 2 = ( 856 , 618 , 7 4 7 , 90 9 , 132 , 636, 0 , 1 , 0 , 0 ) , 
whereby the vector m 2 is regarded as a column of the 

25 coefficient of each monomial of the monomial order 1, X, Y, 
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X 2 , XY, Y 2 , X 3 , X 2 Y, XY 2 , and X 4 of the algebraic curve 
parameter file A to generate a polynomial 
f 2 =8 5 6+618X+7 4 7Y+90 9X 2 +132XY+63 6Y 2 +X 2 Y. 

Similarly, the value of a third vector type of the 
5 first record is (*,*,*,*,*,*, 0 , 0 , 1 , 0 ) (A code * is 

interpreted as representing any number) , which coincides 
with the vector m 3 = ( 652 , 322 , 24 0 , 97 8 , 82 6 , 8 4 6 , 0 , 0 , 1 , 0 ) , 
whereby the vector n\3 is regarded as a column of the 
coefficient of each monomial of the monomial order 1, X, Y, 
10 X 2 , XY, Y 2 , X 3 , X 2 Y, XY 2 , and X 4 of the algebraic curve 
parameter file A to generate a polynomial 

f 3 =652 + 322X+240Y+978X 2 +826XY+846Y 2 +XY 2 . Finally, the ideal 

composition section 11 constructs a set J= {fi,f2,f3l of 

the polynomial to output it. Above, the operation of the 
15 ideal composition section 11 is finished. 

Next, the first ideal reduction section 12, which 

takes as an input the algebraic curve parameter file A of 

Fig. 4, and the Groebner basis 

J= {28 + 132X+31Y+2 71X 2 + 4 69XY+166Y 2 +X 3 , 
20 8 56 + 618X + 7 4 7Y+90 9X 2 + 132XY+636Y 2 +X 2 Y, 

652+322X+24 0Y+97 8X 2 +82 6XY+8 4 6Y 2 +XY 2 } 

that the ideal composition section 11 output, operates as 
follows according to a flow of the process of the 
functional block shown in Fig. 3. 
25 At first, the ideal reduction section 12 makes a 
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reference to an ideal type table 35 of Fig. 5 in an ideal 
type classification section 31 of Fig. 3, retrieves a 
record in which the ideal type described in the ideal type 
field accords with the type of the input ideal J for 
5 obtaining a first record, and acquires a value N=61 of the 
ideal type number field and a value d=3 of the reduction 
order field of the first record. Next, the ideal reduction 
section 12 confirms that said value d=3 is not zero, makes 
a reference to a monomial list table 36 in a polynomial 

10 vector generation section 32, retrieves a record of which 
the value of the order field is said d=3 for obtaining a 
fourth record, and acquires a list 1, X, Y, X 2 , XY, Y 2 , 
and X 3 of the monomial described in the monomial list 
field of the fourth record. 

15 Furthermore, the ideal reduction section 12 acquires a 

first element f=28 + 132X+31Y+271X 2 + 4 69XY+1 66Y 2 +X 3 , a second 
element g-856+618X+747Y+909X 2 +132XY+63 6Y 2 +X 2 Y, and a third 
element h=652 + 322X+240Y+978X 2 +826XY+84 6Y 2 +XY 2 of J in the 
polynomial vector generation section 32, regards a 

20 coefficient list 0, 7, 0, 0, 0, 0, 0, 0, 0, 1, and 1 of 
the algebraic curve parameter file A as a column of the 
coefficient of each monomial of the monomial order 1, X, Y, 
X 2 , XY, Y 2 , X 3 , X 2 Y, XY 2 , X 4 , and Y 3 of the algebraic curve 
parameter file A, and generates a defining polynomial 

25 F=Y 3 +X 4 + 7X. 



Next, for each M ± (l<=i<=7) in said list 1, X, Y, X 2 , 
XY, Y 2 , and X 3 of said monomial, the ideal reduction 
section 12 calculates a remainder equation ri of a product 
Mi • g of Mi and the polynomial g by the polynomials f and 
F in the polynomial vector generation section 32, arranges 
its coefficients in order of the monomial order 1, X, Y, ... 
of the algebraic curve parameter file A, and generates a 
vector w u) i. Furthermore, the ideal reduction section 12 
calculates a remainder equation s± of a product M± • h of M± 
and the polynomial h by the polynomials f and F, arranges 
its coefficient in order of the monomial order 1, X, Y, ... 
of the algebraic curve parameter file A, and generates a 
vector w (1> 2 , and connects the above-mentioned two vectors 
w (1) i and w (1) 2 for generating a vector vi . 

That is, at first, for a first monomial Mi=l, divide 
1 • g=856 + 618X+747Y+909X 2 + 132XY+636Y 2 +X 2 Y by 
f=28+132X+31Y+271X 2 +469XY+166Y 2 +X 3 and F=Y 3 +X 4 +7X: then 
g=0 • f + 0 • F+856 + 618X+747Y+909X 2 + 132XY+636Y 2 +X 2 Y, whereby a 
remainder 856+618X+747Y+909X 2 +132XY+636Y 2 +X 2 Y is obtained 
to generate a vector w (1) x = ( 8 5 6 , 618 , 7 4 7 , 90 9 , 132 , 63 6 , 1 , 0 , 0 ) . 

Also, divide 1-h =652 + 322X+240Y+978X 2 + 826XY+846Y 2 +XY 2 
by f=28 + 132X+31Y+271X 2 +469XY+166Y 2 +X 3 and F=Y 3 +X 4 + 7X: then . 
h=0 • f+0 • F+652 + 322X+240Y+978X 2 + 826XY+846Y 2 +XY 2 , whereby a 
remainder 652 + 322X+240Y+978X 2 +826XY-f 84 6Y 2 +XY 2 is obtained 
to generate a vector w (1) 2 = ( 652 , 322 , 24 0 , 97 8 , 826, 84 6, 0 , 1 , 0 ) . 
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And, the vectors vsr i and } 2 are connected to obtain a 
vector 

vi= (8 56, 61 8,747, 909,132, 63 6,1,0,0, 652, 322, 24 0, 97 8, 826, 846, 
0,1,0) . 

5 Next, for a second monomial M 2 =X, divide 

Xg=X (856+618X+747Y+ 909X 2 + 132XY+636Y 2 +X 2 Y) by 
f=28 + 132X+31Y+271X 2 + 469XY+166Y 2 +X 3 and F=Y 3 +X 4 + 7X: then 
Xg= (319+166Y+Y) f +8 4 3F+14 9+667X+220X 2 +173Y+235XY+7 09X 2 Y 
+ 492Y 2 +863XY 2 , whereby a remainder 
10 149 + 667X+220X 2 +173Y+235XY+709X 2 Y+492Y 2 +863XY 2 is obtained 
to generate a vector 

w (2 \= (14 9, 667, 17 3, 22 0, 2 35, 4 92, 7 0 9, 8 63, 0) . 

Also, divide Xh=X ( 652 + 322X+2 4 OY+97 8X 2 + 82 6XY+8 4 6Y 2 +XY 2 ) 
by f=28 + 132X+31Y+271X 2 + 469XY+166Y 2 -hX 3 and F=Y 3 +X 4 + 7X: 
15 Xh=978f+0 • F+868+708X+651X 2 +961Y+653XY+826X 2 Y+ 
101Y 2 +846XY 2 +X 2 Y 2 , whereby a remainder 

8 68 + 7 08X+651X 2 + 9 61Y+653XY+82 6X 2 Y+101Y 2 + 8 4 6XY 2 +X 2 Y 2 is 
obtained to generate a vector 

w (2) 2 = (868, 708, 961, 651, 653, 101, 826, 846, 1) . And, the vectors 
20 w (2) i and w (2) 2 are connected to obtain a vector 

v 2 = (14 9, 6 67, 173, 220, 235, 4 92, 709, 8 63, 0,8 68, 708, 9 61, 651, 653, 

101, 826, 846, 1) . 

Next, for a third monomial M3=Y, divide 

Yg=Y (856+618X+747Y+909X 2 + 132XY+636Y 2 +X 2 Y) by 
25 f=28 + 132X+31Y+271X 2 +469XY+166Y 2 +X 3 and F=Y 3 +X 4 + 7X: 
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Yg= (826+373X) f +636F+79 + 179X+357X 2 + 475Y+216XY+529X 2 Y+855Y 2 
+ 772XY 2 +X 2 Y 2 , whereby a remainder 

7 9 + 17 9X+357X 2 + 4 7 5Y + 216XY+52 9X 2 Y+8 55Y 2 + 7 72XY 2 +X 2 Y 2 is 
obtained to generate a vector 

5 w (3) i= (79,179, 475, 357,216,855, 52 9, 772,1) . 

Also, divide Yh=Y ( 652+322X+24 0Y+97 8X 2 +82 6XY+8 4 6Y 2 +XY 2 ) 
by f=28 + 132X+31Y+271X 2 +469XY+166Y 2 +X 3 and F=Y 3 +X 4 +7X: then 
Yh= (32 7+5 95X+1008X 2 +4 6 9Y) f+ (68 5+X) F+93 4+9 66X+35 8X 2 +5 90Y 
+ 694XY+473X 2 Y+31Y 2 +939XY 2 +166X 2 Y 2 whereby a remainder 
10 934 + 966X+3 5 8X 2 + 590Y+6 94XY+4 7 3X 2 Y+3lY 2 +93 9XY 2 + 166X 2 Y 2 is 
obtained to generate a vector 

w (3) 2 =(934, 966, 5 90, 358, 694, 31, 473, 93 9, 166) . And, the 

vectors w (3) x and w (3, 2 are connected to obtain a vector 

v 3 = (79, 17 9, 4 75, 357, 216, 8 55, 52 9, 7 72, 1, 934, 966, 5 90, 358, 694, 3 

15 1,473, 939, 166) . 

Next, for a fourth monomial M 4 =X 2 , divide X 2 g= 
X 2 (856 + 618X+747Y+909X 2 + 132XY+636Y 2 +X 2 Y) by 
f=28 + 132X+31Y+27lX 2 + 469XY+166Y 2 +X 3 and F=Y 3 +X 4 + 7X: then 
X 2 g= (64 5 + 969X+166X 2 +7 0 9Y+XY) f+ (359 + 8 4 3X) F+102+2 41X+3 94X 2 

20 513Y+647XY+683X 2 Y+103Y 2 +1004XY 2 +863X 2 Y 2 , whereby a 
remainder 

102 + 241X+3 9 4X 2 + 513Y+64 7XY+68 3X 2 Y+10 3Y 2 + 1004XY 2 +8 63X 2 Y 2 is 
obtained to generate a vector 

w (4) x= (102, 241, 513, 3 94, 64 7, 103, 68 3, 1004, 8 63) . 
25 Also, divide 
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X 2 h=X 2 (652 + 322X+240Y+978X 2 + 826XY+846Y 2 +XY 2 ) by 
f=28+132X+31Y+271X 2 +469XY+166Y 2 +X 3 and F=Y 3 +X 4 +7X: then 
X 2 h= (72 5+16X+782X 2 +7 54Y+166XY+Y 2 ) f + ( 930 + 22 7X+ 8 4 3Y) F+8 8 9 
+ 2 60X+5 60X 2 + 8 0 9Y+42 5XY+552X 2 Y+5 35Y 2 + 671XY 2 +7 63X 2 Y 2 , whereby 
5 a remainder 

8 8 9 + 2 60X+5 60X 2 + 8 0 9Y+425XY+552X 2 Y+535Y 2 + 671XY 2 + 7 63X 2 Y 2 is 
obtained to generate a vector 

w (4) 2 = (88 9, 260, 8 0 9, 5 60, 425, 535, 552, 671, 763) . And, the 
vectors w (4) i and w (4> 2 are connected to obtain a vector 

10 v 4 = (102, 241, 513, 3 94, 64 7, 103, 683, 1004, 8 63, 889, 2 60, 809, 5 60, 
425, 535, 552, 671, 763) . 

Next, for a fifth monomial M 5 =XY, divide 
XYg=XY (856 + 618X+747Y+909X 2 + 132XY+636Y 2 +X 2 Y) by 
f=28 + 132X+3lY+271X 2 -f469XY+166Y 2 +X 3 and F=Y 3 +X 4 + 7X: then 

15 XYg= (95 + 3X+14 6X 2 + 4 57Y+16 6XY+Y 2 ) f+ ( 7 91 + 8 63X+8 4 3Y ) F+367+X 
+ 54X 2 +4 03Y+3 61XY+27 6X 2 Y+305Y 2 +600XY 2 +68 9X 2 Y 2 , whereby a 
remainder 367+X+54X 2 +4 03Y+3 61XY+27 6X 2 Y+305Y 2 +600XY 2 +68 9X 2 Y 2 
is obtained to generate a vector 
w < 5 > 1= (367, 1, 403, 54, 361, 305, 276, 600, 689) . 

20 Also, divide 

XYh-XY (652 + 322X+2 4 0Y+97 8X 2 + 8 2 6XY+8 4 6Y 2 +XY 2 ) by 
f=28 + 132X+31Y+271X 2 +469XY+166Y 2 +X 3 and F=Y 3 +X 4 +7X: then 
XYh= (804 + 648X+246X 2 + 1008X 3 +629Y + 782XY+166Y 2 ) f+ (421 + 25X+X 2 
+ 6 9 6Y) F+695 + 92 4X+28 9X 2 +8 51Y+210XY+321X 2 Y+802Y 2 + 522XY 2 +27 8X 2 

25 Y 2 , whereby a remainder 
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695 + 92 4X+2 8 9X 2 + 8 51Y+210XY+321X 2 Y+8 02Y 2 + 522XY 2 + 2 7 8X 2 Y 2 is 
obtained to generate a vector 

w (5) 2 =( 695, 924, 851,289, 210, 802, 321, 522,278) . And, the 
vectors w <5) i and w (5, 2 are connected to obtain a vector 
5 v 5 = (367, 1,403, 54, 361, 305, 276, 600, 68 9, 695, 924, 851, 289, 210, 
802, 321, 522, 278) . 

Next, for a sixth monomial M 6 =Y 2 , divide 
Y 2 g=Y 2 (856+618X+747Y+909X 2 + 132XY+636Y 2 +X 2 Y) by 
f=28+132X+31Y+271X 2 +469XY+166Y 2 +X 3 and F=Y 3 +X 4 + 7X: then 
10 Y 2 g= (687 + 214X+320X 2 +1008X 3 +77Y+14 6XY+166Y 2 ) f + ( 98 1+9 60X+X 2 
+ 32 3Y) F+94 4 + 3 8 4X+95 6X 2 + 7 63Y+7 37XY+92 5X 2 Y+8 5 9Y 2 + 416XY 2 
+814X 2 Y 2 , whereby a remainder 

94 4 + 38 4X+95 6X 2 +7 63Y+7 3 7XY+925X 2 Y+8 59Y 2 + 416XY 2 + 814X 2 Y 2 is 
obtained to generate a vector 

15 w (6) i=( 94 4, 384, 7 63, 95 6, 7 37, 859, 925, 416, 814) . 

Also, divide 
Y 2 h=Y 2 (652+322X+2 4 0Y+ 97 8X 2 +82 6XY+8 4 6Y 2 +XY 2 ) by 
f=28+132X+31Y+271X 2 +469XY+166Y 2 +X 3 and F=Y 3 +X 4 + 7X: then 
Y 2 h= (2 60 + 17X+7 31X 2 + 8 4 3X 3 +382Y+2 4 6XY+1008X 2 Y+7 82Y 2 ) f 

2 0 (369+8 68X+16 6X 2 +18 6Y+XY) F+7 92+ 9 63X+64 3X 2 +4 1 5Y+539XY+887X 2 Y+ 
438Y 2 +102XY 2 +363X 2 Y 2 , whereby a remainder 

7 92 + 9 63X+64 3X 2 + 415Y+5 3 9XY+8 8 7X 2 Y+4 38Y 2 + 102XY 2 +3 63X 2 Y 2 is 
obtained to generate a vector 

w <6) 2=(792, 963, 415, 643, 539, 438, 887, 102, 363) . And, the 
25 vectors w (6) i and w <6) 2 are connected to obtain a vector 
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v 6 = (944, 384, 7 63, 956, 737, 859, 925 , 4 1 6 , 8 14 , 7 92 , 963, 415, 643, 
539, 438, 887, 102, 363) . 

Finally, for a seventh monomial M 7 =X 3 , divide 
X 3 g=X 3 (856+618X+747Y+909X 2 + 132XY+636Y 2 +X 2 Y) by 
5 f=28 + 132X+31Y+271X 2 + 469XY+166Y 2 +X 3 and F=Y 3 +X 4 + 7X: then 

X 3 g= (323 + 58 3X+814X 2 +166X 3 + 96Y+68 9XY+X 2 Y+8 63Y 2 ) f + ( 698 + 5 14X 
+ 8 4 3X 2 + 20Y) F+37 + 7 30X+83lX 2 + 416Y+13 6XY+55X 2 Y+971Y 2 +398XY 2 
+ 5X 2 Y 2 , whereby a remainder 

37 + 7 30X+8 31X 2 + 416Y+13 6XY+55X 2 Y+971Y 2 + 3 98XY 2 + 5X 2 Y 2 is 

10 obtained to generate a vector 

w (7) i=(37, 730, 416, 831, 136, 971, 55, 398, 5) . 

Also, divide 
X 3 h=X 3 (652 + 322X+240Y+978X 2 + 826XY+846Y 2 +XY 2 ) by 
f=28 + 132X+31Y+271X 2 + 469XY+166Y 2 +X 3 and F=Y 3 +X 4 +7X: then 

15 X 3 h= (449 + 750X+363X 2 + 782X 3 +102Y+278XY+166X 2 Y+763Y 2 +XY 2 ) f+ (784 
+58 3X+22 7X 2 +4 7 6Y+84 3XY) F+54 5+9X+17 3X 2 +37 8Y+902XY+16X 2 Y 
+ 831Y 2 +820XY 2 +909X 2 Y 2 , whereby a remainder 
54 5 + 9X+17 3X 2 + 37 8Y+902XY+16X 2 Y+8 31Y 2 + 82 0XY 2 + 90 9X 2 Y 2 is 
obtained to generate a vector 

20 w (7) 2 = (545, 9, 378, 173, 902, 831, 16, 820, 909) . And, the vectors 
w (7) i and w (7) 2 are connected to obtain a vector 
v 7 = (37, 730, 416, 831, 136, 971, 55, 398, 5, 545, 9, 37 8, 17 3, 902, 8 31, 
16,820,909). Above, the process of the first ideal 
reduction section 12 in the polynomial vector generation 

25 section 32 is finished. 
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Next, in a basis construction section 33 , the first 
ideal reduction section 12 inputs seven 18-dimensional 
vectors vi, v 2 , v 3 , v 4 , v 5 , V6, and v-j , generated in the 
polynomial vector generation section 32 into a linear- 
5 relation derivation section 34, and obtains a plurality of 
seven-dimensional vectors mi, rri2, ... as an output. The 
linear-relation derivation section 34 derives a linear 
relation of the vectors, which were input, employing a 
discharging method. The discharging method belongs to a 
10 known art, whereby as to an operation of the linear- 
relation derivation section 34, only its outline is shown 
below . 

The linear-relation derivation section 34 firstly 
arranges the seven 18-dimensional vectors vi, v 2 , v 3 , v 4 , 
15 v 5 , v 6 , and v 7 , which were input, in order for constructing 
a 7x18 matrix 
[EQ. 14] 

f 856 618 747 909 132 636 1 0 0 652 322 240 978 826 846 0 1 0 } 
149 667 173 220 235 492 709 863 0 868 708 961 651 653 101 826 846 1 
79 179 475 357 216 855 529 772 1 934 966 590 358 694 31 473 939 166 
M R = 102 241 513 394 647 103 683 1004 863 889 260 809 560 425 535 552 671 763 
367 1 403 54 361 305 276 600 689 695 924 851 289 210 802 321 522 278 
944 384 763 956 737 859 925 416 814 792 963 415 643 539 438 887 102 363 
v 37 730 416 831 136 971 55 398 5 545 9 378 173 902 831 16 820 909, 

Next, the linear-relation derivation section 34 
20 connects a seventh-dimensional unity matrix to the matrix 
M R to construct 
[EQ. 15] 
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M' = 



856 618 747 909 132 636 
149 667 173 220 235 492 
79 179 475 357 216 855 
102 241 513 394 647 103 
367 1 403 54 361 305 
944 384 763 956 737 859 
37 730 416 831 136 971 



0 652 322 240 978 826 846 0 1 0 1 0 0 0 0 0 0} 



709 863 0 868 708 961 651 653 101 826 846 1 0 
529 772 1 934 966 590 358 694 31 473 939 166 0 



1 0 0 0 0 0 
0 1 0 0 0 0 



6831004 863 889 260 809 560 425 535 552 671 763 0 0 0 1 0 0 0 



276 600 689 695 924 851 289 210 802 321 522 278 0 
925 416 814 792 963 415 643 539 438 887 102 363 0 
55 398 5 545 9 378 173 902 831 16 820 909 0 



0 0 0 1 0 0 
0 0 0 0 1 0 
0 0 0 0 0 1 



J 



Next, the linear-relation derivation section 34 
triangulates a matrix M' R by adding a constant multiple of 
an i-th row to an (i+l)-th row (i=l,2,and 3) to a seventh 
5 row to obtain the following matrix m. 



[EQ. 16] 



856 618 


747 


909 


132 


636 


1 


0 


0 


652 


322 


240 


978 


826 


846 


0 


1 


0 


1 


0 


0 


0 


0 


0 


0> 


0 62 


485 


393 


47 


320 


677 


863 


0 


184 


494 


344 


634 


455 


272 


826 


814 


1 


977 


1 


0 


0 


0 


0 


0 


0 0 


252 


630 


861 


845 


645 


389 


1 


380 


422 


1006 


632 


736 


748 


221 


979 


217 


281 


51 


1 


0 


0 


0 


0 


0 0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


982 


226 


146 


1 


0 


0 


0 


0 0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


449 


79 


320 


0 


1 


0 


0 


0 0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


544 


564 


195 


0 


0 


1 


0 


0 0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


79 


930 


1004 


0 


0 


0 





As well known, the vector that is composed of a 
nineteenth component and afterward of a fourth row to a 

10 seventh row of the matrix m is a vector { (nii,i, mi,2, mi, 7) , 
(m 2 ,i, m 2/2 , ...,m 2 ,7) 9 —} representing a linearly-independent 
linear dependence relation 2 i 7 rrijiVi=0 ( j = 1 , 2 , ...) of all of 
the seven 18-dimensional vectors v if v 2 , v 3 , v 4 , v 5 , v 6 , and 
v 7 that were input. The linear-relation derivation section 

15 34 outputs a vector mi= (982, 226, 146, 1, 0, 0, 0) that is 

composed of the nineteenth component and afterward of the 
fourth row of the matrix m, a vector 

m 2 = (449, 79, 320, 0, 1, 0, 0) that is composed of the nineteenth 
component and afterward of the fifth row of the matrix m, 



20 



and a vector m 3 = (544 , 564, 195, 0, 0, 1, 0) that is composed of 
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the nineteenth component and afterward of the sixth row of 
the matrix m, and a vector m 4 = ( 7 9 , 930 , 1004 , 0 , 0 , 0 , 1 ) that 
is composed of the nineteenth component and afterward of 
the seventh row of the matrix m. 
5 Now return to the explanation of the process of the 

first ideal reduction section 12 in the basis construction 
section 33. Next, this ideal reduction section 12 makes a 
reference to a table 37 for a Groebner basis construction 
of Fig. 7, and retrieves a record, of which the value of 

10 the order field is said value d=3, and in which a vector 
of which the components that correspond to all component 
numbers described in the component number list field are 
all zero does not lie in said plurality of said vectors 
mi = (982, 22 6, 14 6, 1, 0, 0, 0) , m 2 = (44 9, 7 9, 32 0, 0, 1, 0, 0) , 

15 m 3 =(544, 564, 195,0,0, 1,0) , and m 4 = (79, 930, 1004 , 0, 0, 0, 1) . 

The value of the order field of a fourteenth record is 3, 
and a vector, of which the components that correspond to 
the component number lists 4, 5, 6, and 7 of the 
fourteenth record are all zero, does not lie in the 

20 vectors mi, m 2 , m 3 , and m 4 , whereby the fourteenth record 
is obtained as a retrieval result 

Furthermore, the value of the first vector type of the 
fourteenth record is (*,*,*, 1,0, 0,0) (A code * is 
interpreted as representing any number) , which coincides 

25 with the vector m x = ( 982 , 226, 14 6, 1 , 0 , 0 , 0 ) , whereby the 
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vector mi is regarded as a column of the coefficient of 
each monomial of the monomial order 1, X, Y, X 2 , XY, Y 2 , 
and X 3 of the algebraic curve parameter file A to generate 
a polynomial f !=982+226X+14 6Y+X 2 . 
5 Similarly, the value of the second vector type of the 

fourteenth record is (*,*,*, 0 , 1 , 0 , 0 ) (A code * is 
interpreted as representing any number) , which coincides 
with the vector m 2 = (449, 79, 320, 0, 1, 0, 0) , whereby the 
vector m 2 is regarded as a column of the coefficient of 

10 each monomial of the monomial order 1, X, Y, X 2 , XY, Y 2 , 

and X 3 of the algebraic curve parameter file A to generate 
a polynomial f 2 =449+79X+320Y+XY. 

Similarly, the value of the third vector type of the 
fourteen record is (*,*,*, 0, 0, 1, 0) (A code * is interpreted 

15 as representing any number) , which coincides with the 

vector m 3 = (544, 564, 195, 0, 0, 1, 0) , whereby the vector m 3 is 
regarded as a column of the coefficient of each monomial 
of the monomial order 1, X, Y, X 2 , XY, Y 2 , and X 3 of the 
algebraic curve parameter file A to generate a polynomial 

20 f 3 =54 4+5 64X+195Y+Y 2 . 

Finally, the ideal reduction section 12 constructs a 
set J*= {fi=982 + 226X+146Y+X 2 , f 2 =449+79X+320Y+XY, 
f 3=544 + 564X+195Y+Y 2 } of the polynomial to output it. Above, 
the operation of the first ideal reduction section 12 is 

25 finished. 
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Next, a second ideal reduction section 13, which takes 
as an input the algebraic curve parameter file A 30 of Fig. 
4, and the Groebner basis 

J*= {982 + 226X+146Y+X 2 , 449+79X+320Y+XY, 544 + 564X+ 195Y+Y 2 } 
5 that the first ideal reduction section 12 output, operates 
as follows according to a flow of the process of the 
functional block shown in Fig. 3. At first, in the ideal 
type classification section 31 of Fig. 3, the second ideal 
reduction section 13 makes a reference to the ideal type 

10 table 35 of Fig. 5, retrieves a record in which the ideal 
type described in the ideal type field accords with the 
type of the input ideal J* for obtaining a fourteenth 
record, and acquires a value N=31 of the ideal type number 
field and a value d=3 of the reduction order field of the 

15 fourteenth record. 

Next, the ideal reduction section 13 confirms that 
said value d=3 is not zero, makes a reference to the 
monomial list table 36 in the polynomial vector generation 
section 32, retrieves a record of which the value of the 

20 order field is said d=3 for obtaining a fourth record, and 
acquires a list 1, X, Y, X 2 , XY, Y 2 , and X 3 of the monomial 
described in the monomial list field of the fourth record. 

Furthermore, the ideal reduction section 13 acquires a 
first element f =982+226X+146Y+X 2 , a second element 

25 g=449+79X+320Y+XY, and a third element h=544+564X+195Y+Y 2 
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of J*, regards a coefficient list 0,7,0,0,0,0,0,0,0,1,1 of 
the algebraic curve parameter file A as a column of the 
coefficient of each monomial of the monomial order 1, X, Y, 
X 2 , XY, Y 2 , X 3 , X 2 Y, XY 2 , X 4 , and Y 3 of the algebraic curve 
5 parameter file A, and generates a defining polynomial 
F=Y 3 +X 4 +7X. 

Next, for each of Mi(K=i<=7) in said list 1, X, Y, X 2 , 
XY, Y 2 , and X 3 of said monomial, the ideal reduction 
section 13 calculates a remainder equation ri of a product 

10 Mi • g of Mi and the polynomial g by the polynomials f and F, 
arranges its coefficients in order of the monomial order 1, 
X, Y, ... of the algebraic curve parameter file A, and 
generates a vector w (i) i. Furthermore, the ideal reduction 
section 13 calculates a remainder equation s± of a product 

15 Mi • h of Mi and the polynomial h by the polynomials f and F, 
arranges its coefficients in order of the monomial order 1, 
X, Y, ... of the algebraic curve parameter file A, and 
generates a vector w (1) 2 , and connects the above-mentioned 
two vectors w (i) i and w u) 2 for generating a vector v ± . 

20 That is, at first, for a first monomial Mi=l, divide 

1 • g=449+79X+320Y+XY by f =982+22 6X+14 6Y+X 2 and 
F=Y 3 +X 4 +7X, :then g=0 • f+0 • F+449 + 7 9X+320Y+XY, whereby a 
remainder 44 9+79X+320Y+XY is obtained to generate a vector 
w <i> 1= (449, 79, 320, 1, 0, 0) . Also, divide 1 • h=544+564X+195Y+Y 2 

25 by f=982 + 226X+146Y+X 2 and F=Y 3 +X 4 + 7X: then 



h=0 • f+0 * F+544+564X+195Y+Y 2 , whereby a remainder 

544+564X+195Y+Y 2 is obtained to generate a vector 

w (1) 2 = (544, 564, 195, 0, 1, 0) . And, the vectors w (1) i and w {1) 2 

are connected to obtain a vector 

vi= (449, 7 9, 320, 1,0, 0,54 4, 5 64,1 95, 0, 1, 0) . 

Next, for a second monomial M 2 =X, divide 
Xg=X(449+79X+320Y+XY) by f =982+22 6X+14 6Y+X 2 and F=Y 3 +X 4 + 7X: 
then Xg= (79+Y) f+0 • F+115+757X+601Y+94XY+863Y 2 , whereby a 
remainder 115+757X+601Y+94XY+863Y 2 is obtained to generate 
a vector w (2) i= (115, 757, 601, 94, 863, 0) . 

Also, divide Xh=X ( 544+564X+195Y+Y 2 ) by 
f=982+226X+146Y+X 2 and F=Y 3 +X 4 +7X: then 

Xh=564f+0 • F+93+214X+394Y+195XY+XY 2 , whereby a remainder 
93+214X+394Y+195XY+XY 2 is obtained to generate a vector 
w (2> 2=(93, 214, 394, 195, 0, 1) . And, the vectors w (2) i and w (2) 2 
are connected to obtain a vector 
v 2 = (115, 757, 601, 94, 8 63, 0, 93, 214, 394, 195, 0, 1) . 

Next, for a third monomial M 3 =Y, divide 
Yg=Y (449 + 79X+320Y+XY) by f =982 + 22 6X+14 6Y+X 2 and F=Y 3 +X 4 + 7X: 
then Yg=0 • f+0 • F+449Y+79XY+320Y 2 +XY 2 , whereby a remainder 
449Y+79XY+320Y 2 +XY 2 is obtained to generate a vector 
w (3) != (0, 0, 449, 79, 320, 1) . 

Also, divide Yh=Y (54 4+5 64X+195Y+Y 2 ) by 
f=982+226X+146Y+X 2 and F=Y 3 +X 4 +7X: then 

Yh=(356+226X+1008X 2 +146Y) f + 1 • F+531 + 305X+942Y+157XY+68Y 2 , 
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whereby a remainder 531+305X+942Y+157XY+68Y 2 is obtained 
to generate a vector w (3) 2 = (531, 305, 942, 157, 68, 0) . And, the 
vectors w <3) i and w (3) 2 are connected to obtain a vector 
v 3 =(0, 0, 4 4 9, 7 9, 320, 1, 531, 305, 942 , 157 , 68 , 0 ) . 

Next, for a fourth monomial M 4 =X 2 , divide 
X 2 g=X 2 (449+79X+320Y+XY) by f =982+22 6X+14 6Y+X 2 and 
F=Y 3 +X 4 +7X: then 

x 2 g= (757+79X+94Y+XY) f+0- • F+2 5 9 + 5 63X+988Y+54 6XY+4 02Y 2 + 8 63XY 2 , 
whereby a remainder 259+563X+988Y+546XY+402Y 2 +863XY 2 is 
obtained to generate a vector 
w {4) !=(259, 563, 98 8, 54 6, 4 02, 8 63) . 

Also, divide X 2 h=X 2 (544 + 564X+195Y+Y 2 ) by 
f=982+226X+146Y+X 2 and F=Y 3 +X 4 +7X: then 

x 2 h= (706+865X+146X 2 + 68Y+Y 2 ) f +8 63F+900 + 27X+669Y+611XY+18 9Y 2 + 
783XY 2 , whereby a remainder 900+27X+669Y+611XY+189Y 2 +783XY 2 
is obtained to generate a vector 

w (4) 2 =(900, 27, 669, 611, 189, 783) . And, the vectors w <4) ! and 
w (4> 2 are connected to obtain a vector 

v 4 = (259, 563, 988, 54 6, 402, 8 63, 900, 27, 669, 611, 18 9, 7 83) . 

Next, for a fifth monomial M 5 =XY, divide 
XYg=XY (449+79X+320Y+XY) by f =982+226X+14 6Y+X 2 and 
F=Y 3 +X 4 +7X: then 

XYg= (492 + 301X+146X 2 +961Y+Y 2 ) f +863F+167 + 875X+529Y+648XY+981 
Y 2 +94XY 2 whereby a remainder 

167+875X+529Y+648XY+981Y 2 +94XY 2 is obtained to generate a 
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vector w (5, !=(167, 875, 529, 648, 981, 94) . 
Also, divide XYh=XY (544+564X+195Y+Y 2 ) by 
f=982+226X+146Y+X 2 and F=Y 3 +X 4 +7X: then 

XYh= (305 + 356X+226X 2 + 1008X 3 + 157Y+146XY) f +XF+163+213X+69Y+77 
5XY+285Y 2 +68XY 2 , whereby a remainder 

163+213X+69Y+775XY+285Y 2 +68XY 2 is obtained to generate a 
vector w (5) 2 = (163, 213, 69, 775, 285, 68) . And, the vectors w (5) i 
and w (5> 2 are connected to obtain a vector 
v 5 =( 167, 87 5, 52 9, 64 8, 981, 94, 163, 213, 69, 77 5, 28 5, 68) . 

Next, for a sixth monomial M 6 =Y 2 , divide 
y 2 g=Y 2 ( 449 + 79X+320Y+XY) by f-982 + 22 6X+14 6Y+X 2 and 
F=Y 3 +X 4 +7X: then 

Y 2 g= (2 08 + 2 8X+915X 2 + 10 08X 3 +90 8Y+14 6XY) f+ (32 0+X) F+571 + 94 9X+2 0 
2Y+482XY+60Y 2 +961XY 2 , whereby a remainder 

571 + 949X+202Y+482XY+60Y 2 -i-961XY 2 is obtained to generate a 
vector w (6) i=(571, 949,202, 482, 60, 961) . 

Also, divide Y 2 h=Y 2 ( 544+564X+195Y+Y 2 ) by 
f=982+226X+146Y+X 2 and F=Y 3 +X 4 +7X: then 

Y 2 h- (1001 + 2 33X+941X 2 + 194Y+22 6XY+100 8X 2 Y+14 6Y 2 ) f+ (68+Y) F+7 93 
+560X+352Y+881XY+378Y 2 +157XY 2 , whereby a remainder 
793+560X+352Y+ 881XY+378Y 2 +157XY 2 is obtained to generate a 
vector w (6) 2 = (793, 560, 352, 881, 378, 157) . And, the vectors 
w {6) i and w (6) 2 are connected to obtain a vector 
v 6 =(571, 94 9,202,4 82, 60, 961,793,560,352,881,378,157) . 

Finally, for a seventh monomial M 7 =X 3 , divide X 3 g=X 3 



(449+79X+320Y+XY) by f =982+226X+14 6Y+X 2 and F=Y 3 +X 4 + 7X: 
then 

X 3 g= (370 + 198X+961X 2 +926Y+94XY+X 2 Y + 863Y 2 ) f + 127F+909 + 548X+243 
Y+460XY+104Y 2 +101XY 2 , whereby a remainder 

909+548X+243Y+460XY+104Y 2 +101XY 2 is obtained to generate a 
vector w (7) i= (909, 54 8, 24 3, 4 60, 104, 101) . 

Also, divide X 3 h=X 3 (544+564X+195Y+Y 2 ) by 
f=982 + 226X+146Y+X 2 and F=Y 3 +X 4 +7X: then 

X 3 h= (834+283X+157X 2 + 146X 3 + 52Y+68XY+783Y 2 +XY 2 ) f + (708+863X) F+ 
320 + 866X+720Y+225XY+432Y 2 + 815XY 2 , whereby a remainder 
320+866X+720Y+225XY+432Y 2 +815XY 2 is obtained to generate a 
vector w (7> 2 = (320, 866, 720, 225, 432, 815) . And, the vectors 
w (7) i and w (7) 2 are connected to obtain a vector 
v 7 = (90 9, 54 8,243, 4 60, 104, 101, 320, 8 66, 720, 225, 4 32, 815) . 
Above, the process of the second ideal reduction section 
13 reduction section 13 in the polynomial vector 
generation section 32 is finished- 
Next, in the basis construction section 33, the second 
ideal reduction section 13 inputs seven 12-dimensional 
vectors vi, v 2 , v 3 , v 4 , v 5 , v 6 , and v 7 generated in the 
polynomial vector generation section 32 into the linear- 
relation derivation section 34, and obtains a plurality of 
seven-dimensional vectors mi,m 2 ,... as an output- The 
linear-relation derivation section 34 derives a linear 
relation of the vectors, which were input, employing a 
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10 



15 



discharging method. The discharging method belongs to a 
known art, whereby as to an operation of the linear- 
relation derivation section 34, only its outline is shown 
below . 

The linear-relation derivation section 34 firstly 
arranges the seven 12-dimensional vectors v if v 2 , v 3 , v 4 , 
v 5 , v 6 , and v 7 , which were input, in order for constructing 
a 7x12 matrix 
[EQ. 17] 



M R = 



v 



449 


79 


320 


1 


0 


0 


544 


564 


195 


0 


1 


0 > 


115 


757 


601 


94 


863 


0 


93 


214 


394 


195 


0 


1 


0 


0 


449 


79 


320 


1 


531 


305 


942 


157 


68 


0 


259 


563 


988 


546 


402 


863 


900 


27 


669 


611 


189 


783 


167 


875 


529 


648 


981 


94 


163 


213 


69 


775 


285 


68 


571 


949 


202 


482 


60 


961 


793 


560 


352 


881 


378 


157 


909 


548 


243 


460 


104 


101 


320 


866 


720 


225 


432 


815 ; 



Next, the linear-relation derivation section 34 
connects a seventh-dimensional unity matrix to the matrix 
Mr to construct 



[EQ. 18] 

( 449 79 320 1 0 0 

115 757 601 94 863 0 

0 0 449 79 320 1 

259 563 988 546 402 863 900 27 

167 875 529 648 981 94 163 213 

571 949 202 482 60 961 793 560 352 

v 909 548 243 460 1 04 101 320 866 720 



544 564 195 
93 214 394 
531 305 942 
669 
69 



0 1 0 100000 0^ 

195 0 1 0100000 

157 68 0 0 0 1 0 0 0 0 

611 189 783 0 0 0 1 0 0 0 

775 285 68 0 0 0 0 1 0 0 

881 378 157 0 0 0 0 0 1 0 

225 432 815 0 0 0 0 0 0 1, 



Next, the linear-relation derivation section 34 
triangulates a matrix M f R by adding a constant multiple of 
an i-th row to an (i+l)-th row (i=l,2,and 3) to a seventh 



row to obtain the following a matrix m 



[EQ . 19] 





r 449 


79 


320 


1 0 


0 
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1 


0 


1 0 


0 


0 


0 


0 


0> 




0 


548 


955 


896 863 


0 


493 


510 


389 
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802 


1 


802 1 


0 


0 


0 


0 


0 




0 


0 


449 


79 320 


1 


531 


305 


942 


157 


68 


0 


0 0 


1 


0 


0 


0 


0 


m - 


0 


0 


0 


0 0 


0 


0 


0 


0 


0 


0 


0 


982 226 


146 


1 


0 


0 


0 




0 


0 


0 


0 0 


0 


0 


0 


0 


0 


0 


0 


53 941 


915 


0 


1 


0 


0 




0 


0 


0 


0 0 


0 


0 


0 


0 


0 


0 


0 


394 852 


48 


0 


0 


1 


0 






0 


0 


0 0 


0 


0 


0 


0 


0 


0 


0 


382 194 


908 


0 


0 


0 


h 


As 


well 


known, 


the 


vector that 


is 


composed 


Of 


a 









thirteenth component and afterward of a fourth row to a 
seventh row of the matrix m is a vector { (mi, i, mi, 2 , mi,n) , 
(m 2 ,i,m 2 , 2 ,..., m 2f n) representing a linearly-independent 
linear dependence relation 2 i 7 m ji v i =0 ( j =1 , 2 , ...) of all of 
the seven 12-dimensional vectors v x , v 2 , v 3 , v 4 , v 5 , v 6 , and 
v 7 that were input. The linear-relation derivation section 
34 outputs a vector mi= (982, 226, 146, 1, 0, 0, 0) that is 
composed of the thirteenth component and afterward of the 
fourth row of the matrix m, a vector 

m 2 = (53, 941, 915, 0, 1, 0, 0) that is composed of the thirteenth 
component and afterward of the fifth row of the matrix m, 
and a vector m 3 = ( 3 94 , 8 52 , 4 8 , 0 , 0 , 1 , 0 ) that is composed of 
the thirteenth component and afterward of the sixth row of 
the matrix m, and a vector m 4 = ( 382 , 1 94 , 908 , 0 , 0 , 0 , 1 ) that 
is composed of the thirteenth component and afterward of 
the seventh row of the matrix m. 

Now return to the explanation of the process of the 
second ideal reduction section 13 in the basis 
construction section 33. Next, the second ideal reduction 
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section 13 makes a reference to a table 37 for a Groebner 
basis construction of Fig. 7, and retrieves a record, of 
which the value of the order field is said value d=3, and 
in which a vector of which the components that correspond 
to all component numbers described in the component number 
list field are all zero does not lie in said plurality of 
said vectors mi= ( 982 , 226, 14 6, 1 , 0, 0, 0 ) , 

m 2 =(53, 941, 915, 0,l,0,0), m 3 = ( 3 94 , 8 52 , 4 8 , 0 , 0 , 1 , 0 ) , and 
m 4 = (382, 194, 908, 0, 0, 0, 1) . The value of the order field of 
a fourteenth record is 3, and a vector, of which the 
component that correspond to the component number lists 4, 
5, 6, and 7 of the fourteenth record are all zero, does 
not lie in the vectors m lf m 2 , m 3 , and m 4 , whereby the 
fourteenth record is obtained as a retrieval result. 

Furthermore, the value of the first vector type of the 
fourteenth record is (*,*,*, 1,0, 0,0) (A code * is 
interpreted as representing any number) , which coincides 
with the vector mp ( 982, 226, 146, 1, 0, 0, 0) , whereby the 
vector mi is regarded as a column of the coefficient of 

2 2 

each monomial of the monomial order 1, X, Y, X , XY, Y , 
and X 3 of the algebraic curve parameter file A to generate 
a polynomial f !=982+226X+146Y+X 2 . 

Similarly, the value of the second vector type of the 
fourteenth record is (*,*,*, 0,1, 0,0) (A code * is 
interpreted as representing any number) , which coincides 



with the vector m 2 = (53, 941, 915, 0, 1, 0, 0) , whereby the 
vector m 2 is regarded as a column of the coefficient of 

2 2 

each monomial of the monomial order 1, X, Y, X , XY, Y , 
and X 3 of the algebraic curve parameter file A to generate 
a polynomial f 2 =53+94 1X+915Y+XY . 

Similarly, the value of the third vector type of the 
fourteen record is (*,*,*, 0,0, 1,0) (A code * is interpreted 
as representing any number) , which coincides with the 
vector m 3 = (394, 852, 48, 0, 0, 1, 0) , whereby the vector m 3 is 
regarded as a column of the coefficient of each monomial 
of the monomial order 1, X, Y, X 2 , XY, Y 2 , and X 3 of the 
algebraic curve parameter file A to generate a polynomial 
f 3 =394 + 852X+48Y+Y 2 . Finally, the ideal reduction section 
13 constructs a set J**= {f !=982+226X+146Y+X 2 , 
f 2 =53+941X+915Y+XY, f 3 =3 94 + 8 52X+4 8 Y+Y 2 } of the polynomial to 
output it. Above, the operation of the second ideal 
reduction section 13 is finished. 

Finally, in the Jacobian group element adder of Fig. 1, 
the Groebner basis J**= {982+226X+146Y+X 2 , 

53+941X+915Y+XY, 394+ 852X+48Y+Y 2 } , which the second ideal 
reduction section 13 output, is output from an output 
apparatus . 

Next, the embodiment of the case will be shown in 
which the C 27 curve was employed. In this embodiment, the 
algebraic curve parameter file of Fig. 8 is employed as an 
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algebraic curve parameter file, the ideal type table of 
Fig. 9 as an ideal type table, the monomial list table of 
Fig. 10 as an monomial list table, and the table for a 
Groebner basis construction of Fig. 11 as a table for a 
5 Groebner basis construction respectively. 

In the Jacobian group element adder of Fig. 1, suppose 
Groebner bases 

I x = {689 + 623X+130X 2 +X 3 , 568 + 590X+97 1X 2 +Y} 
and 

10 I 2 = {689 + 623X+130X 2 +X 3 , 568 + 590X+971X 2 +Y} 

were input of the ideal of the coordinate ring of the 
algebraic curve designated by the algebraic curve 
parameter file A, which represents an element of the 
Jacobian group of the C 2 v curve designated by the 

15 algebraic curve parameter file A 16 and the algebraic 
curve parameter file A of Fig. 8. 

At first, an ideal composition section 11, which takes 
the algebraic curve parameter file A of Fig. 8, and the 
above-mentioned Groebner bases Ii and I 2 as an input, 

20 operates as follows according to a flow of the process of 
the functional block shown in Fig. 2. At first, the ideal 
composition section 11 makes a reference to the ideal type 
table of Fig. 9 in the ideal type classification section 
21 of Fig. 2, retrieves a record in which the ideal type 

25 described in the ideal type field accords with the type of 
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the input ideal Ii for obtaining an eleventh record, and 
acquires a value Ni=31 of the ideal type number field and 
a value di=3 of the order field of the eleventh record. 
Similarly, the ideal composition section 11 retrieves a 
5 record in which the ideal type accords with the type of 
the input ideal I 2 for obtaining the eleventh record, and 
acquires a value N 2 =31 of the ideal type number field and 
a value d 2 =3 of the order field of the eleventh record. 

Next, the ideal composition section 11 calculates the 

10 sum d 3 =di+d 2 =6 of said values di=3 and d 2 =3 of said order 

field in the monomial vector generation section 22, makes 
a reference to the monomial list table, retrieves a record 
of which the value of the order field is said d 3 =6 for 
obtaining a first record, and acquires a list 1, X, X 2 , X 3 , 

15 Y, X 4 , XY, X 5 , X 2 Y, and X 6 of the monomial described in the 
monomial list field of the first record. Ii and I 2 are 
equivalent, whereby a remainder to be attained by dividing 
Mi by Ii for each of Mi(K=i<=10) in said list 1, X, X 2 , X 3 , 
Y, X 4 , XY, X 5 , X 2 Y, and X 6 of said monomial is calculated 

20 to obtain a polynomial a (i) i+a (i) 2 X+a (i) 3 X 2 , to arrange its 

2 

coefficients in order of the monomial order 1, X, X , ... of 
the algebraic curve parameter file A, and to generate a 
vector w (i) 1 =(a (i) 1 ,a (i) 2 ,a (i) 3 ) . 

Furthermore, the ideal composition section 11 regards 
25 a coefficient list 0, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, and 
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1 described in the algebraic curve parameter file A of Fig. 
8 as a coefficient row of each monomial of the monomial 
order 1, X, X 2 , X 3 , Y, X 4 , XY, X 5 , X 2 Y, X 6 , X 3 Y, X 7 , and Y 2 
described in the algebraic curve parameter file A of Fig. 
5 8, constructs a defining polynomial F=Y 2 +X 7 +7X, when a 
differential of a polynomial M with respect to its X is 
expressed by D X (M), and a differential of a polynomial M 
with respect to its Y is expressed by D Y (M), calculates a 
remainder to be attained by dividing a polynomial 

10 D x (Mi) D Y (F) -D Y (Mi) D x (F) by Ii, obtains a polynomial 

b (i) i+b (i) 2 X+ b (i> 3 X 2 , arranges its coefficients in order of 
the monomial order 1, X, X 2 , ... of the algebraic curve 
parameter file A, generates a vector w (l) 2 = (b U) i, b U) 2 , b U) 3 ) , 
and connect the above-mentioned two vectors w u) i and w {1) 2 

15 for generating a vector v±= ( a (i) i , a (i} 2 , a (i) 3 , b (i> i , b (i> 2 , b (i> 3 ) - 
That is, divide Mi =1 by Ii: then 

1 = 0 - (689 + 623X+130X 2 +X 3 ) +0 • ( 568+590X+97 1X 2 +Y) + 1, 

whereby, 1 is obtained as a remainder to generate a vector 

w (1} i= (1, 0, 0) . Furthermore, divide D x ( 1 ) D Y ( F) -D Y ( 1 ) D x ( F) -0 

20 by I x : then 0, whereby 0 is obtained as a remainder to 

generate a vector w (1) 2 = (0, 0, 0) . w (1) i and w (1) 2 are connected 
to generate a vector v x = (1, 0, 0, 0, 0, 0) . 

Next, divide M 2 =X by Ii: then 
X=0 • (689 + 623X+130X 2 +X 3 ) +0 • ( 568+590X+97 1X 2 +Y) +X, whereby, 

25 X is obtained as a remainder to generate a vector 
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w (2) i=(0, 1, 0) . Furthermore, divide 
Dx(X) D Y (F) -D Y (X) D x (F)=D y (F)=2Y by 

Ii: then 2Y=0 • ( 689 + 623X+130X 2 +X 3 ) + 2 ( 568 + 590X+971X 2 +Y) 
+882+838X+76X 2 , 

whereby 882+838X+76X 2 is obtained as a remainder to 
generate a vector w (2) 2 = (882, 838, 76) . w (2) ! and w (2) 2 are 
connected to generate a vector v 2 = (0, 1, 0, 882, 838, 76) . 

Next, divide M 3 =X 2 by I x : then 
X 2 =0 • (689+623X+130X 2 +X 3 ) +0 • ( 568 + 590X+971X 2 +Y) +X 2 , whereby, 
X 2 is obtained as a remainder to generate a vector 
w (3) i= (0, 0, 1) . Furthermore, divide D X (X 2 )D Y (F)- 
D Y (X 2 ) D X (F)-4XY by Ii: then 

4XY=152 (68 9 + 623X+130X 2 +X 3 ) +4X (568+590X+971X 2 +Y) +208 + 905X 
+78X 2 , whereby 208+905X+78X 2 is obtained as a remainder to 
generate a vector w (3) 2 = (208 , 905, 78 ) . w (3) x and w (3) 2 are 
connected to generate a vector v 3 = ( 0 , 0 , 1 , 2 08 , 905 , 7 8 ) . 

Next, divide M 4 =X 3 by Ii: then X 3 =l • ( 68 9+623X+130X 2 +X 3 ) 
+ 0 • (568 + 590X+971X 2 +Y) +320 + 386X+879X 2 , whereby, 
320+386X+879X 2 is obtained as a remainder to generate a 
vector w (4) i= (320, 386, 879) . Furthermore, divide D x (X 3 )D y (F)- 
D Y (X 3 ) D x (F) =6X 2 Y by Ii: then 

6X 2 Y= (117 + 228X) ( 68 9 + 623X+130X 2 +X 3 ) +6X 2 ( 568 + 590X+971X 2 +Y) 
+107+69X+778X 2 , whereby 107+69X+778X 2 is obtained as a 
remainder to generate a vector w (4) 2 = (107, 69, 778) . w (4) i and 
w (4) 2 are connected to generate a vector 
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v 4 = (320, 386, 879, 107, 69, 778) . 

Next, divide M 5 =Y by I x : then 
Y=0 • (689 + 623X+130X 2 +X 3 )+l • (568 + 590X+971X 2 +Y) +441 + 419X+38X 2 , 
whereby, 441+419X+38X 2 is obtained as a remainder to 
generate a vector w (5) x = ( 4 4 1 , 4 19 , 38 ) . Furthermore, divide 
D X (Y) D Y (F) -D Y (Y) D x ( F) =-D x ( F) =1002+1002X 6 by Ii, then 
1002 + 1002X 6 =(865+78X+910X 2 +1002X 3 ) ( 68 9+623X+130X 2 +X 3 ) 
+ 0 • (568+590X+971X 2 +Y) +327 + 655X+1004X 2 , whereby 
327+655X+1004X 2 is obtained as a remainder to generate a 
vector w (5) 2 =(327, 655, 1004) . w (5 \ and w (5) 2 are connected to 
generate a vector v 5 = ( 44 1 , 4 19, 38 , 327 , 655 , 1004 ) . 

Next, divide M 6 =X 4 by Ii: then 
X 4 =(879+X) (689 + 623X+130X 2 +X 3 ) +0 • (568 + 590X+971X 2 +Y) 
+778+590X+133X 2 , whereby, 778+590X+133X 2 is obtained as a 
remainder to generate a vector w (6) i= (778, 590, 133) . 
Furthermore, divide D x (X 4 ) D Y (F) -D Y (X 4 ) D X (F)=8X 3 Y by I x : 
then 8X 3 Y=(200 + 840X+8Y) ( 68 9+623X+130X 2 +X 3 ) + ( 542 + 61X+978X 2 ) 
(568+590X+971X 2 +Y) +322+653X+781X 2 , whereby 322+653X+78 IX 2 
is obtained as a remainder to generate a vector 
w (6) 2= (322, 653, 781) . w (6) i and w (6, 2 are connected to generate 
a vector v 6 = (778, 590, 133, 322, 653, 781) . 

Next, divide M 7 =XY by I x : then 
XY=38 (689+623X+130X 2 +X 3 ) +X (568 + 590X+971X 2 +Y) +52 + 983X+524X 2 , 
whereby, 52+983X+524X 2 is obtained as a remainder to 
generate a vector w (7) i= ( 52 , 983 , 524 ) . Furthermore, divide 
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D x (XY)D Y (F)-D Y (XY)Dx(F)=1002X+1002X 7 +2Y 2 by I lf then 

1002X+1002X 7 +2Y 2 = ( 24+72 6X+7 8X 2 +910X 3 +1002X 4 ) 

(68 9+623X+130X 2 +X 3 ) + (882 + 8 38X+7 6X 2 +2Y) ( 568 + 590X+971X 2 +Y) 

+105+954X+813X 2 , whereby 105+954X+813X 2 is obtained as a 

remainder to generate a vector w (7) 2 = ( 105, 954 , 813 ) . w (7> ! 

and w <7) 2 are connected to generate a vector 

v 7 = (52, 983, 524, 105, 954, 813) . 

Next, divide M 8 =X 5 by I x : then 

X 5 =(133 + 879X+X 2 ) (689 + 623X+130X 2 +X 3 ) +0 • ( 568 + 590X+971X 2 +Y) 

+182+657X+453X 2 , whereby, 182+657X+4 53X 2 is obtained as a 
remainder to generate a vector w (8> i= ( 182 , 657 , 453 ) . 
Furthermore, divide D x (X 5 ) D Y (F) -D Y (X 5 ) D x (F) =10X 4 Y by Ii: 
then 10X 4 Y=(912+90X+718Y+10XY) (689+623X+130X 2 +X 3 ) + (717 + 855X 
+ 321X 2 ) (568+590X+971X 2 +Y) +619+878X+281X 2 , whereby 
619+878X+281X 2 is obtained as a remainder to generate a 
vector w (8) 2 =(619, 878, 281) . w (8 \ and w (8) 2 are connected to 
generate a vector v 8 = (182, 657, 453, 619, 878, 281) . 

Next, divide M 9 =X 2 Y by I x : then 
X 2 Y= (524 + 38X) ( 689+623X+130X 2 +X 3 ) +X 2 ( 5 68 + 590X+97 1X 2 +Y) +186 
+516X+466X 2 , whereby, 186+516X+4 66X 2 is obtained as a 
remainder to generate a vector w (9) i= (186, 516, 466) . 
Furthermore, divide 

D X (X 2 Y)D Y (F)-D Y (X 2 Y)D X (F)=1002X 2 +1002X 8 +4XY 2 by Ii: then 
1002X 2 +1002X 8 +4XY 2 = (8 92 + 941X+8 65X 2 +78X 3 +910X 4 +1002X 5 +152Y) 

(689+623X+130X 2 +X 3 ) + (208 + 905X+78X 2 +4XY) (568 + 590X+971X 2 +Y) 
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+811+600X+123X 2 , whereby 811+600X+123X 2 is obtained as a 
remainder to generate a vector w (9) 2 = (811, 600, 123) . w (9) i 
and w {9> 2 are connected to generate a vector 
v 9 = (18 6, 516, 466, 811, 600, 123) . 
5 Next, divide Mi 0 =X 6 by I x : then 

X 6 = (4 53+133X+8 7 9X 2 +X 3 ) ( 68 9+623X+1 30X 2 +X 3 ) 
+0- (568+590X+971X 2 +Y) +673+483X+289X 2 , whereby, 
673+483X+289X 2 is obtained as a remainder to generate a 
vector w (10) i= (673, 483, 289) . Furthermore, divide 

10 D X (X 6 ) D Y (F) -D y (X 6 ) D X (F)=12X 5 Y by Ii: then 

12X 5 Y= (985+732X+587Y+458XY+12X 2 Y) ( 689 + 623X+130X 2 +X 3 ) 
+ (166+821X+391X 2 ) ( 568+590X+971X 2 +Y) +950+741X+201X 2 , whereby 
950+741X+201X 2 is obtained as a remainder to generate a 
vector w (10) 2 = (950, 741, 201) . w (10) i and w {10) 2 are connected to 

15 generate a vector v 10 = ( 673, 483, 289, 950, 741, 201) . Above, 
the process of the ideal composition section 11 in the 
monomial vector generation section 22 is finished. 

Next, in the basis construction section 23, the ideal 
composition section 11 inputs ten six-dimensional vectors 

20 vi, v 2 , v 3 , v 4 , v 5 , v 6 , v 7 , v 8 , v 9 , and, v 10 generated in the 
monomial vector generation section 22 into the linear- 
relation derivation section 24, and obtains a plurality of 
10-dimensional vectors mi,m 2 ,... as an output. The linear- 
relation derivation section 24 derives a linear relation 

25 of the vectors, which were input, employing the 



discharging method. The discharging method belongs to a 
known art, whereby, as to an operation of the linear- 
relation derivation section 24, only its outline is shown 
below. The linear-relation derivation section 24 firstly 
arranges the ten six-dimensional vectors vi, v 2 , v 3 , v 4 , v 5 , 
v 6 , v 7 , v 8 , v 9 , and, v i0 which were input, in order for 
constructing a 10x6 matrix 
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Next, the linear-relation derivation section 24 
connects a 10-dimensional unity matrix to the matrix M c to 
obtain 



M' c = 



v 
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Next, the linear-relation derivation section 24 
triangulates a matrix M' c by adding a constant multiple of 
an i-th row to an (i+l)-th row (i=l, 2 , 6) to a tenth row 
to obtain the following a matrix m. 
[EQ. 22] 
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As well known, the vector that is composed of a 
seventh component and afterward of a seventh row to a 
tenth row of the matrix m is a vector { {m lfl ,m lr2r mi, n ) / 

10 (m 2 ,i,m 2 ,2f m 2 , n ) ' representing a linearly-independent 

linear dependence relation 2 i 10 mjiVi=0 ( j =1 , 2 , ...) of all of 
the ten six-dimensional vectors Vi, v 2 , v 3 , v 4 , v 5 , v 6 , v 7 , 
v 8 , v 9 , and, v i0 that were input. The linear-relation 
derivation section 24 outputs a vector 

15 mi= ( 699, 601, 688, 281, 217, 287, 1, 0, 0, 0) that is composed of 
the seventh component and afterward of the seventh row of 
the matrix m, a vector m 2 = (193, 959, 364, 180, 550, 43, 0, 1, 0, 0) 
that is composed of the seventh component and afterward of 
the eighth row of the matrix m, and a vector 
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m 3 =(780, 667, 96, 50, 897, 327, 0, 0, 1, 0) that is composed of the 
seventh component and afterward of the ninth row of the 
matrix m, and a vector 

m 4 =(761, 727, 417, 523, 278, 912, 0,0, 0,1) that is composed of 
5 the seventh component and afterward of the tenth row of 

the matrix m. Now return to the explanation of the process 
of the ideal composition section 11 in the basis 
construction section 23. 

Next, the ideal composition section 11 makes a 

10 reference to the table for a Groebner basis construction 
of Fig. 11, and retrieves a record, of which the value of 
the order field is said value d 3 =6, and in which a vector 
of which the components that correspond to all component 
numbers described in the component number list field are 

15 all zero does not lie in said plurality of said vectors 
mi- (699, 601, 688, 281, 2 17, 287, 1,0, 0,0), 
m 2 = (193, 959, 3 64 , 18 0 , 550 , 4 3 , 0 , 1, 0, 0), 
m 3 = (780, 667, 9 6 , 50 , 8 97 , 327 , 0 , 0 , 1 , 0 ) , and 

m 4 = (761, 727, 417, 523, 278, 912, 0, 0, 0, 1) . The value of the 
20 order field of the first record is 6, and a vector, of 
which the components correspond to the component number 
lists 7, 8, 9, and 10 of a first record are all zero, does 
not lie in the vectors mi, m 2 , m 3 , and m 4 , whereby the 
first record is obtained as a retrieval result. 
25 Furthermore, the value of the first vector type of the 



first record is (*,*,*,* , * , *, 1 , 0 , 0 , 0 ) (A code * is 
interpreted as representing any number) , which coincides 
with the vector mi= ( 699, 601, 688 , 281 , 217 , 287 , 1, 0 , 0, 0 ) , 
whereby the vector mi is regarded as a column of the 
coefficient of each monomial of the monomial order 1, X, 
X 2 , X 3 , Y, X 4 , XY, X 5 , X 2 Y, and X 6 of the algebraic curve 
parameter file A to generate a polynomial 
f 1= 699 + 601X+68 8X 2 +2 81X 3 + 217Y+287X 4 +XY. 

Similarly, the value of the second vector type of the 
first record is (*,*,*,*,*,*, 0, 1, 0, 0) (A code * is 
interpreted as representing any number) , which coincides 
with the vector m 2 = ( 1 93 , 959 , 3 64 , 18 0 , 550 , 4 3 , 0 , 1 , 0 , 0 ) , 
whereby the vector m 2 is regarded as a column of the 
coefficient of each monomial of the monomial order 1, X, 
X 2 , X 3 , Y, X 4 , XY, X 5 , X 2 Y, and X 6 of the algebraic curve 
parameter file A to generate a polynomial 
f 2 =193 + 959X+364X 2 +180X 3 +550Y+43X 4 +X 5 . The value of the 
third vector type of the first record is null, whereby it 
is neglected. Finally, the ideal composition section 11 
constructs a set J= {fi,f 2 } = 

{ 699 + 60 lX+68 8X 2 + 2 81X 3 + 2 17 Y+287X 4 +XY, 193+95 9X+3 64X 2 +18 0X 3 
+550Y+43X 4 +X 5 } of the polynomial to output it. Above, the 
operation of the ideal composition section 11 is finished. 

Next, the first ideal reduction section 12, which 
takes as an input the algebraic curve parameter file A of 
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Fig. 8, and the Groebner basis J= { 699+601X+688X 2 +281X 3 
+ 217Y+2 87X 4 +XY, 193 + 959X+364X 2 +18 0X 3 +550Y+4 3X 4 +X 5 } 
that the ideal composition section 11 output, operates as 
follows according to a flow of the process of the 
5 functional block shown in Fig. 3. 

At first, in the ideal type classification section 31 
of Fig. 3, the ideal reduction section 12 makes a 
reference to the ideal type table of Fig. 9, retrieves a 
record in which the ideal type described in the ideal type 

10 field accords with the type of the input ideal J for 

obtaining a first record, and acquires a value N=61 of the 
ideal type number field and a value d=3 of the reduction 
order field of the first record. Next, the ideal reduction 
section 12 confirms that said value d=3 is not zero, makes 

15 a reference to the monomial list table of Fig. 10 in the 
polynomial vector generation section 32, retrieves a 
record of which the value of the order field is said d=3 
for obtaining a fourth record, and acquires a list 1, X, 
X 2 , X 3 , Y, X 4 , and XY of the monomial described in the 

20 monomial list field of the fourth record. 

Furthermore, the ideal reduction section 12 acquires a 
first element f =699+601X+688X 2 +281X 3 +217Y+284X 4 +XY of J, 
and a second element g=l 93 + 959X+3 64X 2 +18 0X 3 +550Y+4 3X 4 +X 5 (A 
third element does not lie in J, whereby a third 

25 polynomial h is not employed) , regards a coefficient list 
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0,7,0,0,0,0,0,0,0,0,0,1,1 of the algebraic curve parameter 
file A as a column of the coefficient of each monomial of 
the monomial order 1, X, X 2 , X 3 , Y, X 4 , XY, X 5 , X 2 Y, X 6 , X 3 Y, 
X 7 and Y 2 of the algebraic curve parameter file A, and 
5 generates a defining polynomial F=Y 2 +X 7 + 7X. 

Next, for each of Mi(K=i<=7) in said list 1, X, X 2 , X 3 , 
Y, X 4 and XY of said monomial, the ideal reduction section 
12 calculates a remainder equation r± of a product Mi • g 
of Mi and the polynomial g by the polynomials f and F, 

10 arranges its coefficients in order of the monomial order 1, 
X, X 2 , X 3 , Y, X 4 , XY, X 5 , X 2 Y, X 6 , X 3 Y, and X 7 of the 
algebraic curve parameter file A, and generates a vector 
Vi. That is, at first, for a first monomial Mi=l, divide 
1 • g=193 + 959X+364X 2 +180X 3 +550Y+43X 4 +X 5 by 

15 f=699 + 601X+688X 2 + 281X 3 + 217Y+287X 4 +XY and F=Y 2 +X 7 + 7X: then 
g=0 • f+0 ' F+193 + 959X+364X 2 +180X 3 +550Y+43X 4 + X 5 , whereby a 
remainder 193 + 959X+364X 2 +180X 3 +550Y+43X 4 +X 5 is obtained to 
generate a vector vp ( 193 , 959 , 3 64 , 18 0 , 550 , 4 3 , 0 , 1 , 0 , 0 , 0 , 0 ) . 
Next, for a second monomial M2=X, divide 

20 Xg=X (193 + 959X+364X 2 + 180X 3 +550Y+43X 4 +X 5 ) by 

f=699+601X+688X 2 + 281X 3 + 217Y+287X 4 +XY and F=Y 2 +X 7 + 7X: then 
Xg=550f+0 • F+988 + 595X+934X 2 +191X 3 +743X 4 + 43X 5 +X 6 +721Y, 
whereby a remainder 988 + 595X+934X 2 +191X 3 +743X 4 +43X 5 +X 6 +721Y 
is obtained to generate a vector 

25 v 2 = (988, 595, 934, 191, 721, 743, 0,43, 0,1, 0,0) . 



- 77- 



Next, for a third monomial M 3 =X 2 , divide 
X 2 g=X 2 (193 + 959X+364X 2 +18 0X 3 +550Y+4 3X 4 +X 5 ) by 
f=699 + 601X+688X 2 +281X 3 +217Y+287X 4 +XY and F=Y 2 +X 7 +7X: then 
X 2 g=(721 + 550X) f+0 • F+521 + 528Y+975X 2 +133X 3 + 109X 4 + 743X 5 
5 +43X 6 +X 7 +947Y, whereby a remainder 

521 + 528X+975X 2 +133X 3 +109X 4 + 743X 5 +43X 6 +X 7 +947Y is obtained to 

generate a vector 

v 3 = (521, 528, 975, 133 , 947 , 10 9 , 0 , 7 4 3 , 0 , 4 3 , 0 , 1 ) . 
Next, for a fourth monomial M 4 =X 3 , divide 
10 X 3 g=X 3 (193 + 959X+364X 2 +180X 3 + 550Y+43X 4 +X 5 ) by 

f=699 + 601X+688X 2 +281X 3 +217Y+287X 4 +XY and F=Y 2 +X 7 +7X: then 
X 3 g= (200 + 969X+101X 2 + 287X 3 +1008Y) f + (217+X) F+ 4 51+7 8X+4 8 IX 2 
+ 791X 3 +389X 4 + 924X 5 +527X 6 +195X 7 +686Y, whereby a remainder 
451 + 78X+481X 2 + 791X 3 +389X 4 + 924X 5 +527X 6 +195X 7 + 686Y is obtained 

15 to generate a vector 

v 4 = (451, 78, 481, 791, 686, 389, 0, 924, 0, 527, 0, 195) . 

Next, for a fifth monomial M 5 =Y, divide 
Yg-Y (193 + 959X+364X 2 + 180X 3 + 550Y+43X 4 +X 5 ) by 

f=699 + 601X+688X 2 + 281X 3 + 217Y+287X 4 +XY and F=Y 2 +X 7 + 7X: then 
20 Yg= (884 + 712X+316X 2 + 195X 3 +X 4 + 287Y) f + ( 82 9 + 722X) F+601 + 459X+217 
X 2 +14X 3 + 965X 4 + 924X 5 +130X 6 -i-438X 7 +253Y, whereby a remainder 
601 + 459X+217X 2 + 14X 3 +965X 4 + 924X 5 +130X 6 +438X 7 + 253Y is obtained 

to generate a vector 

v 5 = (601, 4 59, 217, 14,2 53, 965, 0, 924, 0, 130, 0, 4 38) . 
25 Next, for a sixth monomial M 6 =X 4 , divide 
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X 4 g=X 4 (193 + 959X+364X 2 +180X 3 +550Y+43X 4 +X 5 ) by 
f=699+601X+688X 2 +281X 3 +217Y+287X 4 +XY and F=Y 2 +X 7 +7X: then 
X 4 g= (317 + 128X+18 8X 2 +571X 3 +2 8 7X 4 +814Y+1008XY) f + ( 94 6+4 12X+X 2 ) 
F+3 97 + 954X+514X 2 +8 91X 3 +2 55X 4 + 901X 5 +17 3X 6 +90 6X 7 +922Y, whereby 

5 a remainder 

397 + 954X+514X 2 + 8 91X 3 + 255X 4 +901X 5 + 17 3X 6 +90 6X 7 + 922Y is 

obtained to generate a vector 

V6 = (397, 954, 514, 8 91 , 922, 255, 0, 901, 0, 17 3, 0 f 906) . 

Finally, for a seventh monomial M 7 =XY, divide 
10 XYg=XY (193 + 959X+364X 2 + 180X 3 + 550Y+43X 4 +X 5 ) by 

f=699+601X+688X 2 +281X 3 +217Y+287X 4 +XY and F=Y 2 +X 7 + 7X: then 
XYg= (992 + 536X+805X 2 +906X 3 + 195X 4 +X 5 +571Y+287XY) f+ (200+258X 
+ 722X 2 ) F+7 8 4 + 420X+871X 2 +113X 3 +933X 4 + 7 4 9X 5 +153X 6 +112X 7 + 8 8Y, 

whereby a remainder 
15 784 + 420X+871X 2 +113X 3 +933X 4 + 749X 5 +153X 6 +112X 7 + 88Y is obtained 

to generate a vector 

v 7 = (784, 420, 871, 113, 88, 933, 0,749,0, 153, 0, 112) . Above, the 
process of the second ideal reduction section 12 in the 
polynomial vector generation section 32 is finished. 

20 Next, in the basis construction section 33, the second 

ideal reduction section 12 inputs seven 12-dimensional 
vectors v if v 2 , v 3 , v 4 , v 5 , v 6 , and v 7 generated in the 
polynomial vector generation section 32 into the linear- 
relation derivation section 34, and obtains a plurality of 

25 seven-dimensional vectors mi, m 2 , ... as an output. 
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The linear-relation derivation section 34 derives a 
linear relation of the vectors, which were input, 
employing the discharging method. The discharging method 
belongs to a known art, whereby, as to an operation of the 
5 linear-relation derivation section 34, only its outline is 
shown below. The linear-relation derivation section 34 
firstly arranges the seven 12-dimensional vectors vi, v 2 , 
v 3 , v 4 , v 5 , v 6 , and v 7 , which were input, in order for 
constructing a 7x12 matrix 
10 [EQ. 23] 
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Next, the linear-relation derivation section 34 
connects a seven-dimensional unity matrix to the matrix M R 
to construct 
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Next, the linear-relation derivation section 34 
triangulates a matrix M ! R by adding a constant multiple of 
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an i-th row to an (i+l)-th row (i-1,2,3) to a seventh row 
to obtain the following a matrix m. 
[EQ. 25] 



m = 



V 



93 


959 


364 


180 


550 


43 


0 


1 


0 


0 


0 


0 


1 


0 


0 


0 


0 


0 


0 


0 


485 


524 


587 


922 


434 


0 


247 


0 


1 


0 


0 


204 


1 


0 


0 


0 


0 


0 


0 


0 


326 


736 


914 


919 


0 


822 


0 


725 


0 


1 


14 


682 


1 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


804 


795 


814 


1 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


522 


542 


571 


0 


1 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


385 


443 


103 


0 


0 


1 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


12 


627 


897 


0 


0 


0 


1 



5 As well known, the vector that is composed of a 

thirteenth component and afterward of a fourth row to a 
seventh row of the matrix m is a vector { (m^i, mi,2, mi, 7 ) , 
(ni2,i, m 2,2/ iti 2 ,7) representing a linearly-independent 
linear dependence relation 2 i=i 7 m-jiVi=0 ( j =1 , 2 , ...) of all of 

10 the seven 12-dimensional vectors vi, v 2 , v 3 , v 4 , v 5 , v 6 , and 
v 7 that were input. The linear-relation derivation section 
34 outputs a vector m x = ( 804 , 7 95 , 8 14 , 1 , 0 , 0 , 0 ) that is 
composed of the thirteen component and afterward of the 
fourth row of the matrix m, a vector 

15 m 2 = (522, 542, 571, 0, 1, 0, 0) that is composed of the 

thirteenth component and afterward of the fifth row of the 
matrix m, and a vector m 3 = (385, 443, 103, 0, 0, 1, 0) that is 
composed of the thirteenth component and afterward of the 
sixth row of the matrix m, and a vector 

20 m 4 = (12, 627, 897, 0, 0, 0, 1) that is composed of the thirteen 

component and afterward of the seventh row of the matrix m 
Now return to the explanation of the process of the 
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first ideal reduction section 12 in the basis construction 
section 33. Next, this second ideal reduction section 12 
makes a reference to the table for a Groebner basis 
construction of Fig. 11, retrieves a record of which the 
5 value of the order field is said value d=3, and in which a 
vector of which the components that correspond to all 
component numbers described in the component number list 
field are all zero does not lie in said plurality of said 
vectors m x = ( 8 04 , 7 95 , 8 14 , 1 , 0,0,0), m 2 = (522, 542, 571, 0, 1, 0, 0), 

10 m 3 = (38 5, 4 4 3, 103, 0,0, 1,0) , and m 4 = ( 12 , 627 , 8 97 , 0 , 0 , 0 , 1 ) . The 
value of the order field of an eleventh record is 3, and a 
vector, of which the components that correspond to the 
component number lists 4, 5, 6, and 7 of the eleventh 
record are all zero, does not lie in the vectors mi, m 2 , rri3, 

15 and m 4 , whereby the eleventh record is obtained as a 
retrieval result. 

Furthermore, the value of the first vector type of the 
eleventh record is (*,*,*, 1 , 0 , 0 , 0 ) (A code * is 
interpreted as representing any number) , which coincides 

20 with the vector mi= ( 8 04 , 7 95 , 8 14 , 1 , 0 , 0 , 0 ) , whereby the 

vector mi is regarded as a column of the coefficient of 
each monomial of the monomial order 1, X, X 2 , X 3 , Y, X 4 , 
and XY of the algebraic curve parameter file A to generate 
a polynomial f i=804 + 795X+814X 2 +X 3 . 

25 Similarly, the value of the second vector type of the 
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value d=3 of the reduction order field of the eleventh 
record . 

Next, the ideal reduction section 13 confirms that 
said value d=3 is not zero, makes a reference to the 
5 monomial list table of Fig. 10 in the polynomial vector 
generation section 32, retrieves a record of which the 
value of the order field is said d=3 for obtaining a 

2 3 4 

fourth record, and acquires a list 1, X, X , X , Y, X , and 
XY of the monomial described in the monomial list field of 

10 the fourth record. Furthermore, the ideal reduction 

section 13 acquires a first element f =804+7 95X+814X 2 +X 3 , 
and a second element g=522+542X+571X 2 +Y of J* (A third 
element does not lie in J*, whereby a third polynomial h 
is not employed), regards a coefficient list 0, 7, 0, 0, 0, 

15 0, 0, 0, 0, 0, 0, 1, and 1 of the algebraic curve 

parameter file A as a column of the coefficient of each 
monomial of the monomial order 1, X, X 2 , X 3 , Y, X 4 , XY, X 5 , 
X 2 Y, X 6 , X 3 Y, X 7 and Y 2 of the algebraic curve parameter 
file A, and generates a defining polynomial F=Y 2 +X 7 +7X. 

20 Next, for each of Mi(K=i<=7) in said list 1, X, X 2 , X 3 , 

Y, X 4 and XY of said monomial, the ideal reduction section 
13 calculates a remainder equation r ± of a product M ± • g of 
Mi and the polynomial g by the polynomials f and F, 
arranges its coefficients in order of the monomial order 1, 

25 X, X 2 , X 3 , Y, X 4 , XY, X 5 , X 2 Y, X 6 , X 3 Y, and X 7 of the 
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algebraic curve parameter file A, and generates a vector 
Vi . That is, at first, for a first monomial Mi=l, divide 
1 • g=522+542X+571X 2 +Y by f =804+795X+814X 2 +X 3 and F=Y 2 +X 7 + 7X: 
then g=0 • f+0 • F+522+542X+571X 2 +Y, whereby a remainder 
5 522+542X+571X 2 +Y is obtained to generate a vector 
vi= (522, 542, 571, 0, 1,0,0,0,0). 

Next, for a second monomial M 2 =X, divide 
Xg=X (522+542X+571X 2 +Y) by f =804 + 795X+814X 2 +X 3 and 
F=Y 2 +X 7 +7X: then Xg=571f+0 • F+11 + 627X+8 97X 2 +XY, whereby a 
10 remainder 11+627X+8 97X 2 +XY is obtained to generate a 
vector v 2 =(ll, 627, 897, 0, 0, 0, 1, 0, 0) . 

Next, for a third monomial M 3 =X 2 , divide 
X 2 g=X 2 (522+542X+571X 2 +Y) by f =804+795X+814X 2 +X 3 and 
F=Y 2 +X 7 + 7X: then X 2 g= ( 8 97 + 57 IX) f +0 • F+24 7+259X+98 5X 2 +X 2 Y , 
15 whereby a remainder 247+ 259X+985X 2 +X 2 Y is obtained to 
generate a vector v 3 = (247, 259, 985, 0, 0, 0, 0, 0, 1) . 

Next, for a fourth monomial M 4 =X 3 , divide 
X 3 g=X 3 (522 + 542X+571X 2 +Y) by f =804 + 795X+814X 2 +X 3 and 
F=Y 2 +X 7 + 7X: then X 3 g= ( 985 + 897X+571X 2 +Y) f + 0 • F+125 + 156X 
20 +624X 2 +205Y+214XY+195X 2 Y, whereby a remainder 

125+156X+624X 2 +205Y+214XY+195X 2 Y is obtained to generate a 
vector v 4 =(125, 156, 624, 0, 205, 0, 214, 0, 195) . 

Next, for a fifth monomial M 5 =Y, divide 
Yg=Y (522 + 542X+571X 2 +Y) by f =804 + 795X+814X 2 +X 3 and 
25 F=Y 2 +X 7 +7X: then Yg= (486+348X+103X 2 +814X 3 +1008X 4 ) f 
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+ 1 • F+748+780X+665X 2 +522Y+542XY+571X 2 Y, whereby a remainder 
748+780X+665X 2 +522Y+542XY+571X 2 Y is obtained to generate a 
vector v 5 =(748, 780, 665, 0, 522, 0, 542, 0, 571) . 

Next, for a sixth monomial M 6 =X 4 , divide 
5 X 4 g=X 4 (522 + 542X+571X 2 +Y) by f =804+7 95X+8 14X 2 +X 3 and 

F=Y 2 +X 7 + 7X: then X 4 g= ( 624+985X+8 97X 2 + 571X 3 +195Y+XY) f + 0 • 
F+786+473X+756X 2 +624Y+566XY+906X 2 Y, whereby a remainder 
786+473X+756X 2 +624Y+566XY+906X 2 Y is obtained to generate a 
vector v 6 = (78 6, 473, 756,0, 624, 0,566,0, 90 6). 
10 Finally, for a seventh monomial M 7 =XY, divide 

XYg=XY (522+542X+571X 2 +Y by f =8 04 + 7 95X+8 14X 2 +X 3 and 
F=Y 2 +X 7 + 7X: then 

XYg= (665 + 4 8 6X+34 8X 2 + 10 3X 3 +814X 4 + 1008X 5 +571Y) f +XF+110 + 7 8 9X+ 
294X 2 +11Y+627XY+897X 2 Y, whereby a remainder 

15 110+789X+294X 2 +11Y+627XY+897X 2 Y is obtained to generate a 
vector v 7 = (110, 789, 294, 0, 11, 0, 627, 0, 897) . Above, the 
process of the second ideal reduction section 13 in the 
polynomial vector generation section 32 is finished. 

Next, in the basis construction section 33, this ideal 

20 reduction section 13 inputs seven nine-dimensional vectors 
Vi, v 2 , V3, v 4 , v 5 , v 6 , and v 7 generated in the polynomial 
vector generation section 32 into the linear-relation 
derivation section 34, and obtains a plurality of seven- 
dimensional vectors mi, m 2 , ... as an output. The linear- 

25 relation derivation section 34 derives a linear relation 
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of the vectors, which were input, employing the 
discharging method. The discharging method belongs to a 
known art, whereby, as to the operation of the linear- 
relation derivation section 34, only its outline is shown 
5 below. 

The linear-relation derivation section 34 firstly 
arranges the seven nine-dimensional vectors vi, v 2 , v 3 , v 4 , 
V5, v 6 , and v 7f which were input, in order for constructing 
a 7x9 matrix 
10 [EQ. 26] 
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Next, the linear-relation derivation section 34 
connects a seven-dimensional unity matrix to the matrix M R 
to construct 
15 [EQ. 27] 
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Next, the linear-relation derivation section 34 



triangulates a matrix M f R by adding a constant multiple of 
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an i-th row to an (i+l)-th row (i=l,2,3) to a seventh row 
to obtain the following matrix m. 
[EQ. 28] 
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As 


well known, 


the 


vector 


that 


is 


composed 


of a 


tenth 



component and afterward of a fourth row to a seventh row 
of the matrix m is a vector 

{ (mi,i,mi, 2 ,...,mi, n ) , (m 2 ,i,m 2 , 2 , ...,m 2 , n ) , ...} representing a 
linearly-independent linear dependence relation 

10 2i 7 mjiVi=0 ( j=l, 2, ...) of all of the seven 12-dimensional 

vectors v lr v 2 , v 3 , v 4 , v 5 , v 6 , and v 7 that were input. The 
linear-relation derivation section 34 outputs a vector 
mi=(804, 795, 814, 1, 0, 0, 0) that is composed of the tenth 
component and afterward of the fourth row of the matrix m, 

15 a vector m 2 = ( 4 87 , 4 67 , 4 38 , 0 , 1 , 0 , 0 ) that is composed of the 
tenth component and afterward of the fifth row of the 
matrix m, and a vector m 3 = (385, 443, 103, 0, 0, 1, 0) that is 
composed of the tenth component and afterward of the sixth 
row of the matrix m, and a vector m 4 = ( 998 , 382 , 112 , 0 , 0 , 0 , 1 ) 

20 that is composed of the tenth component and afterward of 
the seventh row of the matrix m. 

Now return to the explanation of the process of the 
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second ideal reduction section 13 in the basis 
construction section 33. Next, this ideal reduction 
section 13 makes a reference to the table for a Groebner 
basis construction of Fig. 11, retrieves a record, of 
5 which the value of the order field is said value d=3, and 
in which a vector of which the components that correspond 
to all component numbers described in the component number 
list field are all zero does not lie in said plurality of 
said vectors mi= ( 8 04 , 7 95 , 8 14 , 1 , 0 , 0 , 0 ) , 
10 m 2 =(487,467,438, 0,1,0,0) , m 3 = (385, 443, 103, 0, 0, 1, 0) , and 

m 4 = (998, 382, 112, 0, 0, 0, 1) . The value of the order field of 
an eleventh record is 3, and a vector, of which the 
component number lists 4, 5, 6, and 7 of the eleventh 
record are all zero, does not lie in the vectors mi, m 2 , m 3 , 
15 and m 4 , whereby the eleventh record is obtained as a 
retrieval result. 

Furthermore, the value of the first vector type of the 
eleventh record is (*,*,*, 1, 0, 0, 0) (A code * is interpreted 
as representing any number) , which coincides with the 
20 vector mi= ( 80 4 , 7 95 , 8 14 , 1 , 0 , 0 , 0 ) , whereby the vector m x is 
regarded as a column of the coefficient of each monomial 
of the monomial order 1, X, X 2 , X 3 , Y, X 4 , and XY of the 
algebraic curve parameter file A to generate a polynomial 
f x =8 04+7 95X+814X 2 +X 3 . 
25 Similarly, the value of the second vector type of the 



eleventh record is (*,*,*, 0,1, 0,0) (A code * is interpreted 
as representing any number) , which coincides with the 
vector m 2 = (487, 467, 438, 0, 1, 0, 0) , whereby the vector m 2 is 
regarded as a column of the coefficient of each monomial 
of the monomial order 1, X, X 2 , X 3 , Y, X 4 , and XY of the 
algebraic curve parameter file A to generate a polynomial 
f 2 =487+467X+438X 2 +Y. The value of the third vector type of 
the eleventh record is null, whereby it is neglected. 

Finally, the ideal reduction section 13 constructs a 
set J**= {fi,f 2 } = {804 + 795X+814X 2 +X 3 , 487 + 467X+438X 2 +Y} of 
the polynomial to output it. Above, the operation of the 
second ideal reduction section 13 is finished. Finally, in 
the Jacobian group adder of Fig. 1, the Groebner basis 

{804+795X+814X 2 +X 3 , 487+4 67X+438X 2 +Y} , which the ideal 
reduction section 13 output, is output from the output 
apparatus . 

Next, the embodiment of the case will be shown in 
which the C 25 curve was employed. In this embodiment, the 
algebraic curve parameter file of Fig. 12 is employed as 
an algebraic curve parameter file, the ideal type table of 
Fig. 13 as an ideal type table, the monomial list table of 
Fig. 14 as an monomial list table, and the table for a 
Groebner basis construction of Fig. 15 as a table for a 
Groebner basis construction respectively. 

In the Jacobian group element adder of Fig. 1, suppose 
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Groebner bases 

Ix= {729 + 88X+X 2 , 475+124X+Y} 

and 

I 2 = {180+422X+X 2 , 989+423X+Y } 
5 were input of the ideal of the coordinate ring of the 
algebraic curve designated by the algebraic curve 
parameter file A, which represents an element of the 
Jacobian group of the C 25 curve designated by the 
algebraic curve parameter file A 16 and the algebraic 

10 curve parameter file A of Fig. 12. 

At first, the ideal composition section 11, which 
takes the algebraic curve parameter file A of Fig. 12, and 
the above-mentioned Groebner bases Ii and I 2 as an input, 
operates as follows according to a flow of the process of 

15 the functional block shown in Fig. 2. The ideal 

composition section 11 firstly makes a reference to the 
ideal type table of Fig. 13 in the ideal type 
classification section 21 of Fig. 2, retrieves a record in 
which the ideal type described in the ideal type field 

20 accords with the type of the input ideal Ii for obtaining 
a sixth record, and acquires a value Ni=21 of the ideal 
type number field and a value di=2 of the order field of 
the sixth record. Similarly, the ideal composition section 
11 retrieves a record in which the ideal type accords with 

25 the type of the input ideal I 2 for obtaining the sixth 



record, and acquires a value N 2 =21 of the ideal type 
number field and a value d 2 =2 of the order field of the 
sixth record. 

Next, the ideal composition section 11 calculates the 
sum d 3 =di+d 2 =4 of said values di=2 and d 2 =2 of said order 
field in the monomial vector generation section 22, makes 
a reference to the monomial list table of Fig. 14, 
retrieves a record of which the value of the order field 
is said d 3 =4 for obtaining the first record, and acquires 
a list of the monomial 1, X, X 2 , Y, X 3 , XY, and X 4 
described in the monomial list field of the first record. 
Ii and I 2 are different, whereby a remainder to be attained 
by dividing M± by Ii for each of Mi(K=i<=7) in said list 1 
X, X 2 , Y, X 3 , XY, and X 4 of said monomial is calculated to 
obtained a polynomial a (i) i+a (i) 2 X, to arrange its 
coefficients in order of the monomial order 1, X, ... of the 
algebraic curve parameter file A, and to generate a vector 

w i— \ a i f a 2 ) ' 

Furthermore, the ideal composition section 11 
calculates a remainder to be attained by dividing M ± by I 2 
obtains a polynomial b (i) i+b (i) 2 X, arranges its coefficients 
in order of the monomial order 1, X, ... of the algebraic 
curve parameter file A, generates a vector w U) 2 = (b U) i, b U) 2 ) 
and connects the above-mentioned two vectors w u) i and w u) 2 
for generating a vector v ± = (a (i) i, a (i) 2 , b (i) i, b (i) 2 ) . That is, 
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divide M x =l by I x : then 1=0 - ( 729+88X+X 2 ) +0 • ( 475+124X+Y) +1 , 
whereby 1 is obtained as a remainder to generate a vector 
w (1) i=(l,0). Furthermore, divide Mi =1 by I 2 : then 
1=0 - (180 + 422X+X 2 ) +0 • (989+423X+Y) +1, whereby 1 is obtained 
5 as a remainder to generate a vector w (1) 2 =(l,0) . w (1) ! and 
w (1) 2 are connected to generate a vector vi= (1, 0, 1, 0) . 

Next, divide M 2 =X by Ii: then 
X=0 • (729 + 88X+X 2 ) +0 • (475 + 124X+Y) +X, whereby, X is obtained 
as a remainder to generate a vector w l -'i=(0,l). 

10 Furthermore, divide M 2 =X by I 2 : then 

X=0 • (180+422X+X 2 ) +0 • ( 98 9+423X+Y) +X, whereby X is obtained 
as a remainder to generate a vector w^ , 2 =(0,1). w x and 
w <2) 2 are connected to generate a vector v 2 = ( 0 , 1 , 0 , 1 ) . 
Next, divide M 3 =X 2 by Ii: then 

15 X 2 =l • (729+88X+X 2 ) +0 • ( 4 7 5 + 12 4X+Y) +2 8 0+921X, whereby, 

280+921X is obtained as a remainder to generate a vector 
w {3) i= (280, 921) . Furthermore, divide M 3 =X 2 by I 2 : then 
X 2 =l • (180 + 422X+X 2 ) +0 • (989 + 423X+Y) +829 + 587X, whereby 
829+587X is obtained as a remainder to generate a vector 

20 w (3) 2 = (829, 587) . w (3) i and w (3> 2 are connected to generate a 
vector v 3 =(280, 921, 829, 587) . 

Next, divide M 4 =Y by I x : then 
Y=0 • (729 + 88X+X 2 ) +1 • (475 + 124X+Y) +534 + 885X, whereby 
534+885X is obtained as a remainder to generate a vector 

25 w (4) i= (534, 885) . Furthermore, divide M 4 =Y by I 2 : then 
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Y=0 • (180+422X+X 2 ) -hi • ( 989 + 423X+Y) +20+586X, whereby 20 + 586X 
is obtained as a remainder to generate a vector 
w (4) 2 = (20, 586) . w (4) i and w (4) 2 are connected to generate a 
vector v 4 =(534, 885, 20, 586) . 

Next, divide M 5 =X 3 by Ii: then 
X 3 =(921+X) (729+88X+X 2 ) +0 • ( 475+124X+Y) +585+961X, whereby 
585+961X is obtained as a remainder to generate a vector 
w <5> i=(585, 961) . 

Furthermore, divide M 5 =X 3 by I 2 : then 
X 3 =(587+X) (180+422X+X 2 ) +0 • ( 989+423X+Y) +285 + 320X, whereby 
285+320X is obtained as a remainder to generate a vector 
w (5) 2 = (285, 320) . w (5) i and w (5) 2 are connected to generate a 
vector v 5 =(585, 961,285, 320) . Next, divide M 6 =XY by Ii: then 
XY=885 (729 + 88X+X 2 ) +X • (475+124X+Y) +595+347X, whereby 
595+347X is obtained as a remainder to generate a vector 
w (6 \= (595, 347) . 

Furthermore, divide M 6 =XY by I 2 : then 
XY=58 6 (18 0+422X+X 2 ) +X ( 98 9+4 2 3X+Y) +4 65 + 94 2X, whereby 
465+942X is obtained as a remainder to generate a vector 
w (6) 2 = (465, 942) . w (6) i and w (6) 2 are connected to generate a 
vector v 6 =(595,347,465,942) . 

Finally, divide M 7 =X 4 by I x : then 
X 4 = (961+921X+X 2 ) (729+88X+X 2 ) +0 • (475+124X+Y) +686+773X, 
whereby, 686+773X is obtained as a remainder to generate a 
vector w (7) i= (686, 773) . Furthermore, divide M 7 =X 4 by I 2 : 
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then X 4 = (320+587X+X 2 ) ( 180+422X+X 2 ) +0 • ( 98 9+423X+Y) +922 + 4 51X, 
whereby 922+451X is obtained as a remainder to generate a 
vector w (7) 2 = (922, 451) . w (7) x and w {7) 2 are connected to 
generate a vector v 7 = ( 686, 773, 922 , 451) . Above, the process 
5 of the ideal composition section 11 in the monomial vector 
generation section 22 is finished. 

Next, in the basis construction section 23, the ideal 
composition section 11 inputs seven four-dimensional 
vectors vi, v 2 , v 3 , v 4 , v 5 , v 6 , and v 7 generated in the 

10 monomial vector generation section 22 into the linear- 
relation derivation section 24, and obtains a plurality of 
seven-dimensional vectors mi, m 2 , ... as an output. The 
linear-relation derivation section 24 derives a linear 
relation of the vectors, which were input, employing the 

15 discharging method. The discharging method belongs to a 
known art, whereby, as to the operation of the linear- 
relation derivation section 24, only its outline is shown 
below. The linear-relation derivation section 24 firstly 
arranges the seven four-dimensional vectors vi, v 2 , v 3 , v 4 , 

20 v 5 , v 6 , and v 7# which were input, in order for constructing 
a 7x4 matrix 
[EQ. 29] 
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IVL = 



1 o 1 o ^ 

0 10 1 

280 921 829 587 

534 885 20 586 

585 961 285 320 

595 347 465 942 

v 686 773 922 451^ 

Next, the linear-relation derivation section 24 

connects a seven-dimensional unity matrix to the matrix M c 

to obtain 



[EQ. 30] 
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M' c = 
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Next, the linear-relation derivation section 24 
triangulates a matrix M f c by adding a constant multiple of 
an i-th row to an (i+l)-th row ( i=l, 2 , 4 ) to a seventh 
row to obtain the following a matrix m. 

[EQ. 31] 
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m = 



v 



1 


0 


1 


0 


1 


0 


0 


0 


0 


0 


0> 


0 


1 


0 


1 


0 


1 


0 


0 


0 


0 


0 


0 


0 


549 


675 


729 


88 
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As well known, the vector that is composed of a fifth 
component and afterward of a fifth row to a seventh row of 



15 



the matrix m is a vector 



{ (mi, i, mi, 2 , ...,mi /7 ) , (m 2 ,i,m 2 ,2, ...,m 2 , 7 ) , •••} representing a 
linearly-independent linear dependence relation 
Ei=i 7 m ji Vi=0 ( j=l, 2, ...) of all of the seven four-dimensional 
vectors Vi, v 2 , v 3/ v 4 , v 5 , v 6 , and v 7 that were input. 

The linear-relation derivation section 24 outputs a 
vector mi- (444 , 709, 900, 42, 1, 0, 0) that is composed of the 
fifth component and afterward of the fifth row of the 
matrix m, a vector m 2 = ( 969 , 7 1 6 , 94 0 , 61 9 , 0 , 1 , 0 ) that is 
composed of the fifth component and afterward of the sixth 
row of the matrix m, and a vector 

m 3 =(635,230,807,778, 0,0,1) that is composed of the fifth 
component and afterward of the seventh row of the matrix m. 

Now return to the explanation of the process of the 
ideal composition section 11 in the basis construction 
section 23. Next, the ideal composition section 11 makes a 
reference to the table for a Groebner basis construction 
of Fig. 15, retrieves a record, of which the value of the 
order field is said value d 3 =4, and in which a vector of 
which the components that correspond to all component 
numbers described in the component number list field are 
all zero does not lie in said plurality of said vectors 
mi=( 444,709, 900, 42, 1,0,0) , m 2 = ( 969 , 7 16 , 94 0 , 61 9 , 0 , 1 , 0 ) , and 
m 3 = (635, 230, 807, 778, 0, 0, 1) . The value of the order field 
of a first record is 4, and a vector, of which the 
components that correspond to the component number lists, 
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5, 6, and 7 of the first record are all zero, does not lie 
in the vectors mi, m 2 , and m 3 , whereby the first record is 
obtained as a retrieval result. 

Furthermore, the value of the first vector type of the 
first record is (*,*,*,*, 1,0,0) (A code * is interpreted as 
representing any number) , which coincides with the vector 
mi= (444, 709, 900, 42, 1, 0, 0) , whereby the vector mi is 
regarded as a column of the coefficient of each monomial 
of the monomial order 1, X, X 2 , Y, X 3 , XY, and X 4 of the 
algebraic curve parameter file A to generate a polynomial 
f 1= 4 4 4 + 7 0 9X+900X 2 + 42Y+X 3 . 

Similarly, the value of the second vector type of the 
first record is (*,*,*,*, 0,1,0) (A code * is interpreted as 
representing any number) , which coincides with the vector 
m 2 = (969, 716, 940, 619, 0, 1, 0) , whereby the vector m 2 is 
regarded as a column of the coefficient of each monomial 
of the monomial order 1, X, X 2 , Y, X 3 , XY, and X 4 of the 
algebraic curve parameter file A to generate a polynomial 
f 2 =969+716X+940X 2 +619Y+XY. The value of the third vector 
type of the first record is null, whereby it is neglected. 
Finally, the ideal composition section 11 constructs a set 
J= {fi,f 2 } = {444 + 709X+900X 2 + 42Y+X 3 , 969 + 716X+940X 2 + 619Y+XY} 
of the polynomial to output it. Above, the operation of 
the ideal composition section 11 is finished. 

Next, the first ideal reduction section 12, which 
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takes as an input the algebraic curve parameter file A of 
Fig. 12, and the Groebner bases 

j= {444+709X+900X 2 +42Y+X 3 , 969+716X+940X 2 +619Y+XY} that the 
ideal composition section 11 output, operates as follows 
5 according to a flow of the process of the functional block 
shown in Fig. 3. At first, the first ideal reduction 
section 12 makes a reference to the ideal type table of 
Fig. 12 in the ideal type classification section 31 of Fig. 
3, retrieves a record in which the ideal type described in 

10 the ideal type field accords with the type of the input 

ideal J for obtaining a first record, and acquires a value 
N=41 of the ideal type number field and a value d=2 of the 
reduction order field of the first record. 

Next, the ideal reduction section 12 confirms that 

15 said value d=2 is not zero, makes a reference to the 

monomial list table of Fig. 14 in the polynomial vector 
generation section 32, retrieves a record of which the 
value of the order field is said d=2 for obtaining a third 
record, and acquires a list 1, X, X 2 , and Y of the 

20 monomial described in the monomial list field of the third 
record. Furthermore, the ideal reduction section 12 
acquires a first element f =444+709X+900X 2 +42Y+X 3 , and a 
second element g=969 + 716X+940X 2 + 619Y+XY of J (A third 
element does not lie in J, whereby a third polynomial h is 

25 not employed), regards a coefficient list 0, 7, 0, 0, 0, 0, 
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0, 0, 1, and 1 of the algebraic curve parameter file A as 
a column of the coefficient of each monomial of the 
monomial order 1, X, X 2 , Y, X 3 , XY, X 4 , X 2 Y, X 5 , and Y 2 of 
the algebraic curve parameter file A, and generates a 
5 defining polynomial F=Y 2 +X 5 +7X. 

Next, for each of Mi(l<=i<=4) in said list 1, X, X 2 , 
and Y of said monomial, the ideal reduction section 12 
calculates a remainder equation r ± of a product Mi • g of 
Mi and the polynomial g by the polynomials f and F, 
10 arranges its coefficients in order of the monomial order 1, 
X f X 2 , Y, X 3 , XY, X 4 , and X 2 Y of the algebraic curve 
parameter file A, and generates a vector v ± . That is, at 
first, for a first monomial Mi=l, divide 1 • 
g=969+716X+940X 2 +619Y+XY by f =444 + 709X+ 900X 2 +42Y+X 3 and 

15 F=Y 2 +X 5 +7X: then 

g=0 • f+0 • F+ 969 + 716X+940X 2 +619Y+XY, whereby a remainder 

969+716X+940X 2 +619Y+XY is obtained to generate a vector 

vi= (969, 716, 94 0, 619, 0, 1, 0, 0) . 

Next, a second monomial M 2 =X, divide 
20 Xg=X(969+716X+940X 2 +619Y+XY) by f =444+709X+900X 2 +42Y+X 3 and 

F=Y 2 +X 5 +7X: then Xg=940f + 0 • F+366+44 9X+258X 2 +880Y+619XY+X 2 Y, 

whereby a remainder 366+449X+258X 2 +880Y+619XY+X 2 Y is 

obtained to generate a vector 

V2 = (366, 44 9, 2 58, 88 0, 0, 619, 0, 1) . 
25 Next, a third monomial M 3 = X 2 , divide 
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X 2 g=X 2 (969+716X+940X 2 +619Y+XY) by f =444 + 709X+900X 2 +42Y+X 3 
and F=Y 2 +X 5 +7X: then X 2 g= (297+473X+ 42X 2 +Y) 
f+967F+311+4 62X+19 9X 2 +199Y+614XY+982X 2 Y, whereby a 
remainder 311+4 62X+199X 2 +199Y+614XY+982X 2 Y is obtained to 
5 generate a vector v 3 = ( 311 , 4 62 , 199 , 199 , 0 , 614 , 0 , 982 ) . 
Finally, a fourth monomial M 4 =Y, divide 
Yg=Y (969+716X+940X 2 +619Y+XY) by f =444+709X+900X 2 +42Y+X 3 and 
F=Y 2 +X 5 +7X: then Yg= ( 994 + 625X+27X 2 +1008X 3 +42Y) f 
+ (873+X) F+606+463X+322X 2 +104Y+183XY+348X 2 Y, whereby a 

10 remainder 606+463X+322X 2 +104Y+183XY+348X 2 Y is obtained to 
generate a vector v 4 = (606, 463, 322, 104, 0, 183, 0, 348) . Above, 
the process of the ideal reduction section 12 in the 
polynomial vector generation section 32 is finished. 

Next, in the basis construction section 33, the first 

15 ideal reduction section 12 inputs four eight-dimensional 
vectors vi, v 2 , v 3 , and v 4 generated in the polynomial 
vector generation section 32 into the linear-relation 
derivation section 34, and obtains a plurality of four- 
dimensional vectors mi, m 2 , ... as an output. The linear- 

20 relation derivation section 34 derives a linear relation 
of the vectors, which were input, employing the 
discharging method. The discharging method belongs to a 
known art, whereby, as to the operation of the linear- 
relation derivation section 34, only its outline is shown 

25 below. 
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The linear-relation derivation section 34 firstly 
arranges the four eight-dimensional vectors vi, v 2 , v 3 , and, 
v 4 , which were input, in order for constructing a 4x8 
matrix 



[EQ. 32] 
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Next, the linear-relation derivation section 34 
connects a four-dimensional unity matrix to the matrix M R 
to construct 

[EQ . 33] 
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Next, the linear-relation derivation section 34 
triangulates a matrix M f R by adding a constant multiple of 
an i-th row to an (i+l)-th row (i=l,2) to a fourth row to 
obtain the following matrix m. 



[EQ. 34] 
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As well known, the vector that is composed of a ninth 
component and afterward of a third row and a fourth row of 
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the matrix m is a vector 

{ (mi, i, mi, 2 , ...,itii, 4 ) , (m 2 ,i,m 2 ,2, ...,m 2 , 4 ) / .»} representing a 
linearly-independent linear dependence relation 
2i=i 4 mjiVi=0 ( j=l, 2, ...) of all of the four eight-dimensional 
5 vectors Vi, v 2 , v 3 , and v 4 that were input. The linear- 
relation derivation section 34 outputs a vector 
m x =(835, 27, 1, 0) that is composed of the ninth component 
and afterward of the third row of the matrix m, and a 
vector m 2 = (312, 661, 0, 1) that is composed of the ninth 
10 component and afterward of the fourth row of the matrix m. 

Now return to the explanation of the process of the 
first ideal reduction section 12 in the basis construction 
section 33. Next, the ideal reduction section 12 makes a 
reference to the table for a Groebner basis construction 
15 of Fig. 15, and retrieves a record, of which the value of 
the order field is said value d=2, and in which a vector 
of which the components that correspond to all component 
numbers described in the component number list field are 
all zero does not lie in said plurality of said vectors 
20 mi=(835,27,l,0) , and m 2 = ( 312 , 661 , 0 , 1 ) . The value of the 

order field of a sixth record is 2, and a vector, of which 
the components that correspond to the component number 
lists 3 and 4 of the sixth 'record are all zero, does not 
lie in the vectors mi and m 2 , whereby the sixth record is 
25 obtained as a retrieval result. 
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Furthermore, the value of the first vector type of the 
sixth record is (*,*,1,0) (A code * is interpreted as 
representing any number) , which coincides with the vector 
mi= (835, 27, 1, 0) , whereby the vector mi is regarded as a 
column of the coefficient of each monomial of the monomial 
order 1, X, X 2 , and Y of the algebraic curve parameter 
file A to generate a polynomial f i=8 35+27X+X 2 . Similarly, 
the value of the second vector type of the sixth record is 
(*,*,0,1) (A code * is interpreted as representing any 
number), which coincides with the vector m 2 = ( 312 , 661 , 0, 1 ) , 
whereby the vector m 2 is regarded as a column of the 
coefficient of each monomial of the monomial order 1, X, 
X 2 ,and Y of the algebraic curve parameter file A to 
generate a polynomial f 2 =312+661X+Y . The value of the 
third vector type of the sixth record is null, whereby it 
is neglected. Finally, the ideal reduction section 12 
constructs a set J*= {fi,f 2 } = {835+27X+X 2 , 312 + 661X+Y} of 
the polynomial to output it. Above, the operation of the 
first ideal reduction section 12 is finished. 

Next, the second ideal reduction section 13, which 
takes as an input the algebraic curve parameter file A of 
Fig. 12, and the Groebner basis J*= {fi,f 2 } = 

{835+27X+X 2 , 312 + 661X+Y} that the first ideal reduction 
section 12 output, operates as follows according to a flow 
of the process of the functional block shown in Fig. 3. At 
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first / the second ideal reduction section 13 makes a 
reference to the ideal type table of Fig. 13 in the ideal 
type classification section 31 of Fig. 3, retrieves a 
record in which the ideal type described in the ideal type 
5 field accords with the type of the input ideal J* for 

obtaining a sixth record, and acquires a value N=21 of the 
ideal type number field and a value d=2 of the reduction 
order field of the sixth record. 

Next, the ideal reduction section 13 confirms that 

10 said value d=2 is not zero, makes a reference to the 

monomial list table of Fig. 14 in the polynomial vector 
generation section 32, retrieves a record of which the 
value of the order field is said d=2 for obtaining a third 
record, and acquires a list 1, X, X 2 , and Y of the 

15 monomial described in the monomial list field of the third 
record. Furthermore, the ideal reduction section 13 
acquires a first element f =835+27X+X 2 , and a second 
element g=312+661X+Y of J* (A third element does not lie 
in J*, whereby a third polynomial h is not employed) , 

20 regards a coefficient list 0, 7, 0, 0, 0, 0, 0, 0, 1, and 
1 of the algebraic curve parameter file A as a column of 
the coefficient of each monomial of the monomial order 1, 
X, X 2 , Y, X 3 , XY, X 4 , X 2 Y, X 5 , and Y 2 of the algebraic curve 
parameter file A, and generates a defining polynomial 

25 F=Y 2 +X 5 +7X. 
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Next, for each of Mi(K=i<=4) in said list 1, X, X 2 and 
Y of said monomial, the ideal reduction section 13 
calculates a remainder equation r± of a product Mi • g of M± 
and the polynomial g by the polynomials f and F, arranges 
5 its coefficients in order of the monomial order 1, X, X 2 , 
Y, X 3 , XY , X 4 , and X 2 Y of the algebraic curve parameter 
file A, and generates a vector v±. That is, at first, for 
a first monomial Mi=l, divide 1 • g=312 + 661X+Y by 
f=835 + 27X+X 2 and F=Y 2 +X 5 +7X: then g=0 • f + 0 • F+312+661X+Y, 

10 whereby a remainder 312+661X+Y is obtained to generate a 
vector vi= (312, 661, 0, 1, 0, 0) . 

Next, a second monomial M 2 =X, divide Xg=X ( 312+661X+Y) 
by f=835 + 27X+X 2 and F=Y 2 +X 5 +7X: then Xg=661f+0 • 
F+997+627X+XY, whereby a remainder 997+627X+XY is obtained 

15 to generate a vector v 2 = ( 997 , 627 , 0 , 0 , 0 , 1 ) . Next, a third 

monomial M 3 = X 2 , divide X 2 g= X 2 ( 312 + 661X+Y) by f=835+27X+X 2 
and F=Y 2 +X 5 +7X: then X 2 g= ( 627 + 661X+Y) f +0 • 
F+126+212X+174Y+982XY, whereby a remainder 
126+212X+174Y+982XY is obtained to generate a vector 

20 v 3 =(126, 212, 0,174, 0,982) . 

Finally, a fourth monomial M 4 =Y, divide 
Yg=Y ( 312 + 661X+Y) by f=835 + 27X+X 2 and F=Y 2 +X 5 +7X: then 
Yg= (827 + 106X+27X 2 + 1008X 3 ) f+1 • F+620 + 144X+312Y+661XY, 
whereby a remainder 620+144X+312Y+661XY is obtained to 

25 generate a vector v 4 = ( 620 , 14 4 , 0 , 312 , 0 , 661 ) . Above, the 
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process of the second ideal reduction section 13 in the 
polynomial vector generation section 32 is finished. 

Next, in the basis construction section 33, this 
second ideal reduction section 13 inputs four six- 
dimensional vectors vi, v 2 , v 3 , and v 4 generated in the 
polynomial vector generation section 32 into the linear- 
relation derivation section 34, and obtains a plurality of 
four-dimensional vectors mi, m 2 , ... as an output. The 
linear-relation derivation section 34 derives a linear 
relation of the vectors, which were input, employing the 
discharging method. The discharging method belongs to a 
known art, whereby, as to the operation of the linear- 
relation derivation section 34, only its outline is shown 
below . 

The linear-relation derivation section 34 firstly 
arranges the four six-dimensional vectors vi, v 2 , v 3 , and, 
v 4/ which were input, in order for constructing a 4x6 
matrix 
[EQ. 35] 

' 312 661 0 1 0 0 > 
997 627 0 0 0 1 

Mo = 

R 126 212 0 174 0 982 
, 620 144 0 312 0 661, 

Next, the linear-relation derivation section 34 
connects a four-dimensional unity matrix to the matrix M R 
to construct 
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[EQ. 36] 



Mr- 



312 


661 
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0 
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0 




997 


627 
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126 


212 
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174 


0 


982 


0 


0 


1 


0 


620 


144 


0 


312 


0 


661 


0 


0 


0 


h 



Next, the linear-relation derivation section 34 
triangulates a matrix M' R by adding a constant multiple of 
5 an i-th row to an (i+l)-th row (i=l,2) to a fourth row to 
obtain the following matrix m. 
[EQ. 37] 

r 312 661 0 1 0 0 1 0 0 0^ 
0 536 0 815 0 1 815 1 0 0 
m= 0 0 0 0 0 0 835 27 1 0 
^ 0 0 0 0 0 0 697 348 0 ^ 

As well known, the vector that is composed of a 
10 seventh component and afterward of a third row and a 
fourth row of the matrix m is a vector 

{ (mi, i, mi, 2 , .... m 1/4 ) , (m 2 ,i,m 2 , 2 , ...,m 2 ,4) , -} representing a 
linearly-independent linear dependence relation 
2i=i 4 mjiVi=0 ( j=l, 2 , ...) of all of the four six-dimensional 
15 vectors vi, v 2 , v 3/ and v 4 that were input. 

The linear-relation derivation section 34 outputs a 
vector m x = (835, 27, 1, 0) that is composed of the seventh 
component and afterward of the third row of the matrix m, 
and a vector m 2 = ( 697 , 348 , 0 , 1 ) that is composed of the 
20 seventh component and afterward of the fourth row of the 
matrix m. Now return to the explanation of the process of 
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the ideal reduction section 13 in the basis construction 
section 33. Next, the ideal reduction section 13 makes a 
reference to the table for a Groebner basis construction 
of Fig. 15, retrieves a record, of which the value of the 
5 order field is said value d=2, and in which a vector of 
which the components that correspond to all component 
numbers described in the component number list field are 
all zero does not lie in said plurality of said vectors 
mi=(835,27, 1, 0) , and m 2 = ( 697 , 34 8 , 0 , 1 ) . The value of the 

10 order field of a sixth record is 2, and a vector, of which 
the component number lists 3 and 4 of the sixth record are 
all zero, does not lie in the vectors m x , and m 2 , whereby 
the sixth record is obtained as a retrieval result. 

Furthermore, the value of the first vector type of the 

15 sixth record is (*,*,1,0) (A code * is interpreted as 

representing any number) , which coincides with the vector 
mi= (835, 27, 1, 0) , whereby the vector mi is regarded as a 
column of the coefficient of each monomial of the monomial 
order 1, X, X 2 , and Y of the algebraic curve parameter 

20 file A to generate a polynomial f i=835+27X+X 2 . Similarly, 

the value of the second vector type of the sixth record is 
(*,*,0,1) (A code * is interpreted as representing any 
number), which coincides with the vector m 2 = ( 697 , 34 8 , 0 , 1 ) , 
whereby the vector m 2 is regarded as a column of the 

25 coefficient of each monomial of the monomial order 1, X, 
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X 2 ,and Y of the algebraic curve parameter file A to 
generate a polynomial f 2 =697+348X+Y . The value of the 
third vector type of the sixth record is null, whereby it 
is neglected. Finally, the ideal reduction section 13 
5 constructs a set J**= {fi,f 2 } = {835+27X+X 2 , 697 + 348X+Y} of 
the polynomial to output it. Above, the operation of the 
ideal reduction section 13 is finished. 
Finally, in the Jacobian group adder of Fig. 1, the 
Groebner basis J**= {835 + 27X+X 2 , 697 + 348X+Y} , which the 

10 second ideal reduction section 13 output, is output from 
the output apparatus. 

The effect exists: employment of the present invention 
allows the addition in the Jacobian group of the C a b curve 
to be calculated at a high speed, and practicality of the 

15 C a b curve to be enhanced. 

The present invention has been described with 
reference to the preferred embodiments. However, it will 
be appreciated by those skilled in the relevant field that 
a number of other embodiments, differing from those 

20 specifically described, will also fall within the sprit 
and scope of the present invention. Accordingly, it will 
be understood that the invention is not intended to be 
limited to the embodiments described in the specification. 
The scope of the invention is only limited by attached 

25 claims. 
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The entire disclosure of Japanese Patent Application 
No. 2002-240034 filed on August 21, 2002 including 
specification, claims, drawing and summary are 
incorporated herein by reference in its entirety. 



